# syntax=docker/dockerfile:1
# Multi-stage build for the tavolo stack (Rust/Axum backend +
# Sycamore/WASM frontend). The Docker build context is the REPOSITORY ROOT
# (see docker-compose.yml) so this single image assembles both parts:
#
#   web-builder   rust + trunk -> compiles web/ into web/dist
#   rust-builder  rust          -> compiles server/ into the tavolo binary
#   runtime       debian slim   -> the binary + the compiled frontend
#
# The backend embeds its sqlx migrations, serves /static and /assets itself
# and hosts the SPA shell, so the runtime image needs no Python, Granian or
# migration files.
#
# Build and run it with (from the repository root):
#   docker compose up --build

# --- Web builder -------------------------------------------------------------
FROM rust:1-slim-bookworm AS web-builder

ARG TRUNK_VERSION=0.21.14
# The build environment blocks plain HTTP: force the apt mirrors to HTTPS.
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list 2>/dev/null || true; } \
 && { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; } \
 && apt-get update \
 && apt-get install -y --no-install-recommends curl ca-certificates \
 && curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
      | tar -xz -C /usr/local/bin \
 && rustup target add wasm32-unknown-unknown

WORKDIR /web

# Card images are committed in the repository (CC0 woodcut napoletane deck);
# web/fetch-cards.sh can regenerate them.
COPY web/Cargo.toml web/Cargo.lock web/index.html web/style.css web/theme.css web/Trunk.toml ./
COPY web/assets ./assets
# Vendored Bootstrap (MIT) loaded by index.html; kept out of the CDN so the
# image builds and runs without network access.
COPY web/vendor ./vendor
COPY web/src ./src

# --public-url makes trunk emit asset URLs under /static, the prefix the
# server mounts in the runtime image. Dev builds (trunk serve) keep the
# default "/" public URL.
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/web/target \
    trunk build --release --public-url /static/

# --- Rust builder ------------------------------------------------------------
FROM rust:1-slim-bookworm AS rust-builder

WORKDIR /build

COPY server/Cargo.toml server/Cargo.lock ./
COPY server/crates ./crates

# The target directory lives in a cache mount (so repeated builds reuse it)
# and the binary is copied out of the mount into the image layer.
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/build/target \
    cargo build --release --locked \
 && cp target/release/tavolo /tavolo

# --- Runtime -----------------------------------------------------------------
FROM debian:bookworm-slim

# The slim base ships no CA store; seed it from the builder so the HTTPS apt
# mirrors (and later, outbound TLS) can be verified.
COPY --from=web-builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list 2>/dev/null || true; } \
 && { sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; } \
 && apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl tzdata \
 && rm -rf /var/lib/apt/lists/* \
 && addgroup --system app && adduser --system --ingroup app app

COPY --from=rust-builder /tavolo /usr/local/bin/tavolo
# The compiled single-page application: hashed js/wasm/css under /static and
# the card images under /assets (mounted by the server from STATIC_DIR).
COPY --from=web-builder /web/dist /app/web/dist

ENV STATIC_DIR=/app/web/dist

USER app

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
  CMD curl -fsS http://127.0.0.1:8080/api/health || exit 1

CMD ["tavolo", "serve"]