FROM node:24-bookworm-slim AS web-build
WORKDIR /workspace/apps/web
COPY apps/web/package.json apps/web/package-lock.json* ./
RUN npm install
COPY apps/web/ ./
RUN npm run build

FROM golang:1.24-bookworm AS server-build
WORKDIR /workspace
RUN apt-get update && apt-get install -y --no-install-recommends build-essential ca-certificates && rm -rf /var/lib/apt/lists/*
COPY go.work ./
COPY apps/server/go.mod apps/server/go.sum* ./apps/server/
WORKDIR /workspace/apps/server
RUN go mod download
COPY apps/server/ ./
RUN CGO_ENABLED=1 go build -trimpath -ldflags="-s -w" -o /workspace/md-hub-secure ./cmd/md-hub-secure

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
RUN useradd --create-home --shell /usr/sbin/nologin appuser
WORKDIR /workspace
COPY --from=server-build /workspace/md-hub-secure /usr/local/bin/md-hub-secure
COPY --from=web-build /workspace/apps/web/dist /workspace/web-dist
COPY content /workspace/content
RUN mkdir -p /workspace/data/files && chown -R appuser:appuser /workspace
USER appuser
EXPOSE 8080
ENV MD_HUB_SERVER_ADDR=:8080
ENV MD_HUB_DATABASE_PATH=/workspace/data/db.sqlite
ENV MD_HUB_CONTENT_SOURCE_DIR=/workspace/content
ENV MD_HUB_CONTENT_STORE_DIR=/workspace/data/files
ENV MD_HUB_WEB_DIST_DIR=/workspace/web-dist
HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=5 CMD curl --fail http://127.0.0.1:8080/health || exit 1
ENTRYPOINT ["/usr/local/bin/md-hub-secure"]