FROM debian:bookworm-slim AS api-builder
RUN apt-get update && apt-get install -y curl build-essential pkg-config libssl-dev ca-certificates && rm -rf /var/lib/apt/lists/*
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
ENV PATH="/root/.cargo/bin:${PATH}"
WORKDIR /app
COPY api/ .
ARG CARGO_FEATURES=""
RUN cargo build --release --features "${CARGO_FEATURES}"

FROM debian:bookworm-slim AS web-builder
RUN apt-get update && apt-get install -y curl ca-certificates gnupg && \
    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
    apt-get install -y nodejs && \
    rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY web/package.json web/package-lock.json ./
RUN npm ci
COPY web/ .
RUN npm run build-only

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates curl && rm -rf /var/lib/apt/lists/* \
    && groupadd --system opdb && useradd --system --gid opdb --create-home opdb
COPY --from=api-builder /app/target/release/openposterdb-api /usr/local/bin/openposterdb
COPY --from=web-builder /app/dist /app/dist
RUN mkdir -p /data/cache /data/db && chown -R opdb:opdb /data
ENV STATIC_DIR=/app/dist
ENV CACHE_DIR=/data/cache
ENV DB_DIR=/data/db
EXPOSE 3000
HEALTHCHECK --interval=10s --timeout=3s --start-period=15s \
    CMD curl -sf http://localhost:3000/health || exit 1
USER opdb
CMD ["openposterdb"]