# Build the frontend bundle (vite), then the static tefterd binary that
# embeds it, then ship binary-only. VERSION flows in from compose
# (${TEFTER_VERSION}) so `tefterd version` matches the git describe.

# Fully-qualified images (podman enforces short-name resolution non-interactively).
FROM docker.io/library/node:22-alpine AS frontend
WORKDIR /src/frontend
COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY frontend/ ./
ARG VERSION=dev
RUN TEFTER_VERSION=$VERSION npx vite build

FROM docker.io/library/golang:1.25-alpine AS build
# git enables the GOPROXY "direct" fallback (fetch modules from their VCS).
RUN apk add --no-cache git
# Overridable for hosts where proxy.golang.org (Google) is unreachable —
# set e.g. GOPROXY=https://goproxy.io,direct in .env.docker. Module
# integrity is still verified against the committed go.sum either way.
ARG GOPROXY=https://proxy.golang.org,direct
ENV GOPROXY=$GOPROXY
WORKDIR /src/server
COPY server/go.mod server/go.sum ./
RUN go mod download
COPY server/ ./
# go:embed cannot reach outside the module dir, so the bundle is copied in
# (same as the Makefile does).
COPY --from=frontend /src/frontend/dist ./webdist/dist
ARG VERSION=dev
RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=$VERSION" -o /tefterd .

FROM docker.io/library/alpine:3.22
RUN adduser -D -H tefter && mkdir -p /data && chown tefter /data
COPY --from=build /tefterd /usr/local/bin/tefterd
USER tefter
ENV TEFTER_DB=/data/tefter.db
# The auth token is generated and printed to the logs on first start.
EXPOSE 8420
VOLUME /data
CMD ["tefterd"]