# syntax=docker/dockerfile:1
FROM node:24-bookworm-slim AS build
WORKDIR /app
COPY platform/package.json platform/package-lock.json ./platform/
# The optional CA secret is used only in this managed build environment.
RUN --mount=type=secret,id=proxy_ca \
    if [ -f /run/secrets/proxy_ca ]; then NODE_EXTRA_CA_CERTS=/run/secrets/proxy_ca npm ci --prefix platform --ignore-scripts --no-audit --no-fund; else npm ci --prefix platform --ignore-scripts --no-audit --no-fund; fi
COPY . .
# Python builds archives; system CAs also support local workerd verification.
RUN --mount=type=secret,id=proxy_ca \
    apt-get update && apt-get install -y --no-install-recommends python3 ca-certificates && rm -rf /var/lib/apt/lists/*
RUN npm --prefix platform run build
FROM node:24-bookworm-slim
WORKDIR /app
ENV NODE_ENV=production BIND_ADDRESS=0.0.0.0 PORT=8080 NODE_USE_ENV_PROXY=1
COPY --from=build /app/platform/node_modules ./platform/node_modules
COPY --from=build /app/platform/selfhost ./platform/selfhost
COPY --from=build /app/platform/dist/server ./platform/dist/server
COPY --from=build /app/platform/drizzle ./platform/drizzle
COPY --from=build /app/platform/package.json ./platform/package.json
COPY --from=build /app/packages ./packages
COPY --from=build /app/.github/templates ./.github/templates
RUN chmod -R a+rX /app && mkdir -p /app/data && chown node:node /app/data
USER node
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s CMD node -e "fetch('http://127.0.0.1:8080/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node","platform/selfhost/server.mjs"]
