# syntax=docker/dockerfile:1
# Production image for @insignia/iios-service (the single IIOS backend).
# Build context MUST be the monorepo ROOT (it needs the workspace + lockfile):
#   docker build -f packages/iios-service/Dockerfile -t iios-service:latest .
#
# Multi-stage: (1) build the service + its workspace deps and prune to a
# self-contained prod bundle via `pnpm deploy`; (2) a slim runtime that only
# carries that bundle. Migrations run at container start (see docker-entrypoint.sh).

ARG NODE_VERSION=22-bookworm-slim
ARG PNPM_VERSION=10.6.2

# ── build ───────────────────────────────────────────────────────────────────
FROM node:${NODE_VERSION} AS build
ARG PNPM_VERSION
ENV PNPM_HOME=/pnpm PATH=/pnpm:$PATH
# openssl + ca-certificates are required by Prisma's engine on debian-slim.
RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
  && rm -rf /var/lib/apt/lists/*
RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate

WORKDIR /repo
COPY . .

# Full install (needs devDeps to compile), then build ONLY the service + its
# workspace dependencies, generate the Prisma client, and emit a pruned prod bundle.
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
    pnpm install --frozen-lockfile
# Generate the Prisma client BEFORE compiling — nest build (tsc) needs its types,
# otherwise Prisma results are `any` and noImplicitAny fails the build.
RUN pnpm --filter @insignia/iios-service exec prisma generate \
 && pnpm --filter "@insignia/iios-service..." build \
 && pnpm --filter @insignia/iios-service --prod --legacy deploy /app

# ── runtime ──────────────────────────────────────────────────────────────────
FROM node:${NODE_VERSION} AS runtime
ENV NODE_ENV=production
# Prisma engine needs openssl at runtime too.
RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=build /app ./
# Regenerate the Prisma client against the final filesystem (deterministic).
RUN node_modules/.bin/prisma generate

# Run as the built-in non-root `node` user.
RUN chmod +x docker-entrypoint.sh && chown -R node:node /app
USER node

EXPOSE 3200
ENV PORT=3200
# migrate deploy → start; see docker-entrypoint.sh.
ENTRYPOINT ["./docker-entrypoint.sh"]