# UpNext Server - Multi-stage build

# Stage 1: Build frontend
FROM oven/bun:1 AS frontend-builder

WORKDIR /app/web

# Copy frontend package files
COPY packages/server/web/package.json packages/server/web/bun.lock* ./

# Install dependencies
RUN bun install --frozen-lockfile

# Copy frontend source
COPY packages/server/web ./

# Build frontend (outputs to ../src/server/static)
RUN bun run build && mv ../src/server/static /static

# Stage 2: Python server
FROM python:3.12-slim

WORKDIR /app

# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpq-dev \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Install uv
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# Copy workspace config and lock file
COPY pyproject.toml uv.lock ./

# Copy packages
COPY packages/shared ./packages/shared
COPY packages/server ./packages/server

# Copy built frontend
COPY --from=frontend-builder /static ./packages/server/src/server/static

# Install dependencies using workspace
RUN uv sync --frozen --no-dev --package upnext-server

# Create an unprivileged runtime user.
RUN useradd --create-home --home-dir /home/upnext --shell /usr/sbin/nologin upnext \
    && mkdir -p /home/upnext/.upnext \
    && chown -R upnext:upnext /app /home/upnext

# Set working directory to server package
WORKDIR /app/packages/server

# Run server as non-root.
USER upnext
ENV HOME=/home/upnext

# Expose port
EXPOSE 8080

# Start server
CMD ["uv", "run", "--no-sync", "uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "8080"]
