# syntax=docker/dockerfile:1.7
#
# ALM Talent - web image (Nuxt 3 SSR, Nitro node-server). DRAFT for Stage 6 (prep/deploy).
#
# Platform: linux/amd64, built on the server (Hostinger KVM 2, D-057; DEPLOY.md §1.3).
# Build context = repository root:
#   docker build -f deploy/docker/client/Dockerfile -t alm-local/alm-talent-web:<sha> --build-arg ALM_GIT_SHA=<sha> .
#
# The Nuxt build needs a large Node heap (PLAN_TECH_NOTES T24): 6144 MB (NUXT_BUILD_HEAP_MB); a 4 GB heap ran
# out of memory (BUILD_LOG M7). On the 8 GB server scripts/redeploy-from-pc.sh adds a temporary 8 GB swap file
# (/swapfile-build) for the build and removes it afterwards; build in a quiet hour.
#
# Runtime values: NUXT_PUBLIC_* / NUXT_* that are read through useRuntimeConfig() (for example the API
# proxy target of server/utils/alm-proxy.ts, NUXT_PRIVATE_API_BASE) come from the container
# environment (docker-compose.yml). routeRules in nuxt.config.ts are NOT runtime: they are fixed at
# build time, which is why the API proxies are server routes and why NUXT_PRIVATE_API_BASE is also set
# for the build below (belt and braces, audit r1 Q2).

ARG NODE_IMAGE=node:24-alpine

# --------------------------------------------------------------------------------------------------
FROM ${NODE_IMAGE} AS build
WORKDIR /app
ENV NUXT_TELEMETRY_DISABLED=1 \
    CI=1

# Dependencies first (cached while package-lock.json is unchanged). devDependencies are needed:
# nuxt itself is one, so NODE_ENV must NOT be "production" here.
COPY client/package.json client/package-lock.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci --no-audit --no-fund

COPY client/ ./
ARG NUXT_BUILD_HEAP_MB=6144
# Build-time values (read by nuxt.config.ts while building, NOT at runtime):
# - NUXT_PUBLIC_ALM_CSP_PROFILE: the build stage has no NODE_ENV=production (devDependencies are needed), so
#   without this the ALM layer falls back to the "dev" profile = no Content-Security-Policy and no HSTS.
# - NUXT_PRIVATE_API_BASE: the compose-network address of the API (Caddy's internal :8080 site), the same value
#   docker-compose.yml gives the running container. The API proxies read it at runtime (server/utils/alm-proxy.ts);
#   setting it for the build too is belt and braces (audit r1 Q2).
# - NUXT_PUBLIC_ALM_UPLOAD_HOSTS: space-separated origins the browser uploads to, added to the CSP connect-src by
#   layers/alm/base/nuxt.config.ts: presigned R2 PUTs (path-style <account>.r2.cloudflarestorage.com or virtual-host
#   <bucket>.<account>.r2.cloudflarestorage.com; a CSP "https://*." source matches both) and Bunny Stream TUS
#   uploads (video.bunnycdn.com). docker-compose.yml passes the value from .env.production (same default).
ARG NUXT_PUBLIC_ALM_CSP_PROFILE=production
ARG NUXT_PRIVATE_API_BASE=http://caddy:8080/api
ARG NUXT_PUBLIC_ALM_UPLOAD_HOSTS="https://*.r2.cloudflarestorage.com https://video.bunnycdn.com"
ENV NUXT_PRIVATE_API_BASE=${NUXT_PRIVATE_API_BASE}
RUN NODE_OPTIONS="--max-old-space-size=${NUXT_BUILD_HEAP_MB}" \
    NUXT_PUBLIC_ALM_CSP_PROFILE="${NUXT_PUBLIC_ALM_CSP_PROFILE}" \
    NUXT_PUBLIC_ALM_UPLOAD_HOSTS="${NUXT_PUBLIC_ALM_UPLOAD_HOSTS}" \
    npx nuxt build

RUN test -f .output/server/index.mjs

# --------------------------------------------------------------------------------------------------
FROM ${NODE_IMAGE} AS runtime
WORKDIR /app
ENV NODE_ENV=production \
    NITRO_HOST=0.0.0.0 \
    NITRO_PORT=3000 \
    NUXT_TELEMETRY_DISABLED=1 \
    TZ=UTC
COPY --from=build --chown=node:node /app/.output ./

ARG ALM_GIT_SHA=unknown
ARG ALM_VERSION=0.0.0-dev
ENV ALM_BUILD_SHA=${ALM_GIT_SHA} \
    ALM_BUILD_VERSION=${ALM_VERSION}
LABEL org.opencontainers.image.title="alm-talent-web" \
      org.opencontainers.image.description="ALM Talent web front end (Nuxt SSR, based on OpnForm)" \
      org.opencontainers.image.licenses="AGPL-3.0-only" \
      org.opencontainers.image.revision="${ALM_GIT_SHA}" \
      org.opencontainers.image.version="${ALM_VERSION}" \
      org.opencontainers.image.source="https://github.com/Almano-2/ALM-Talent-Platform"

USER node
EXPOSE 3000
CMD ["node", "server/index.mjs"]
