# Node dependencies
FROM public.ecr.aws/docker/library/node:18-alpine AS frontend-dependencies
WORKDIR /app
RUN npm install -g pnpm
COPY frontend/package.json frontend/pnpm-lock.yaml ./ 
RUN pnpm install --frozen-lockfile --shamefully-hoist

# Build Nuxt
FROM public.ecr.aws/docker/library/node:18-alpine AS frontend-builder
WORKDIR /app
COPY frontend ./ 
COPY --from=frontend-dependencies /app/node_modules ./node_modules
RUN pnpm build

# Build Go dependencies
FROM public.ecr.aws/docker/library/golang:alpine AS builder-dependencies
WORKDIR /go/src/app
COPY ./backend/go.mod ./backend/go.sum ./ 
RUN apk update && apk add --no-cache git \
    && go mod download

# Build API
FROM public.ecr.aws/docker/library/golang:alpine AS builder
ARG BUILD_TIME
ARG COMMIT
ARG VERSION

RUN apk update && apk upgrade && apk add --no-cache git build-base gcc g++ \
    && addgroup -S nonroot && adduser -S nonroot -G nonroot

WORKDIR /go/src/app
COPY ./backend ./ 
RUN rm -rf ./app/api/public
COPY --from=frontend-builder /app/.output/public ./app/api/static/public
COPY --from=builder-dependencies /go/pkg/mod /go/pkg/mod

# Use cache for Go build
RUN --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 GOOS=linux go build \
    -ldflags "-s -w -X main.commit=$COMMIT -X main.buildTime=$BUILD_TIME -X main.version=$VERSION" \
    -o /go/bin/api ./app/api/*.go

# Change ownership of files to nonroot
RUN chown -R nonroot:nonroot /go/bin/api /go/src/app

# Production stage with distroless
FROM ghcr.io/distroless/base:latest

ENV HBOX_MODE=production
ENV HBOX_STORAGE_DATA=/data/
ENV HBOX_STORAGE_SQLITE_URL=/data/homebox.db?_fk=1&_time_format=sqlite

# Copy the binary and data directory
COPY --from=builder /go/bin/api /app
COPY --from=builder /data /data

# Copy curl and its dependencies from Alpine image into distroless
# Also copy the libraries that curl depends on (if required)
COPY --from=public.ecr.aws/docker/library/alpine:latest /lib/libssl.so.* /lib/
# Copy curl from alpine to the distroless image
COPY --from=public.ecr.aws/docker/library/alpine:latest /usr/bin/curl /usr/bin/curl

LABEL Name=homebox Version=0.0.1
LABEL org.opencontainers.image.source="https://github.com/sysadminsmedia/homebox"
EXPOSE 7745

# Update HEALTHCHECK to use curl
HEALTHCHECK --interval=30s \
            --timeout=5s \
            --start-period=5s \
            --retries=3 \
            CMD ["/usr/bin/curl", "--silent", "--fail", "http://localhost:7745/api/v1/status"]

VOLUME ["/data"]

# Use nonroot user
USER nonroot
ENTRYPOINT ["/app"]
CMD ["/data/config.yml"]