# syntax=docker/dockerfile:1.7
#
# Eleva Speed — production image for the Next.js app.
#
# Multi-stage:
#   1. deps     — install pnpm deps with frozen lockfile (cached layer)
#   2. builder  — run `next build` to emit `.next/standalone`
#   3. runner   — minimal image: node, the standalone server, static + public
#
# The runner stage does NOT include pnpm, the source tree, or node_modules.
# Standalone output ships its own minimal `node_modules` under `.next/standalone`.

ARG NODE_VERSION=24-alpine

# ---------- deps ----------
FROM node:${NODE_VERSION} AS deps
WORKDIR /app

# libc6-compat is needed by some Node.js native deps on Alpine (sharp, etc.)
RUN apk add --no-cache libc6-compat

# Enable corepack — it dispatches to whichever pnpm version package.json
# pins via the `packageManager` field. We don't hardcode a version here;
# `corepack install` (no args) reads it from the local package.json, so
# bumping pnpm is a single edit in package.json.
RUN corepack enable

COPY package.json pnpm-lock.yaml ./

# Pre-download the pinned pnpm version, then install deps with the frozen
# lockfile. NOTE: BuildKit `--mount=type=cache` is intentionally NOT used
# so the Dockerfile builds with the legacy Docker builder too (Colima
# ships without the buildx plugin by default). Docker's layer cache still
# kicks in on subsequent builds as long as the lockfile hasn't changed.
RUN corepack install \
 && pnpm install --frozen-lockfile

# ---------- builder ----------
FROM node:${NODE_VERSION} AS builder
WORKDIR /app

RUN apk add --no-cache libc6-compat \
 && corepack enable

COPY --from=deps /app/node_modules ./node_modules
COPY . .

# Same approach as the `deps` stage — read the pinned pnpm version from
# package.json instead of hardcoding it in the Dockerfile.
RUN corepack install

ENV NEXT_TELEMETRY_DISABLED=1
ENV NODE_ENV=production

# Build-time placeholders. `lib/env.ts` runs Zod validation at module-import
# time (project rule: "validation stricte au build"). During `next build`,
# Next.js loads every route module to collect page data — that triggers the
# validator with whatever env the build process has. Real values are injected
# at runtime via the compose `env_file: .env.prod`; nothing here ends up in
# the final runner image (different FROM, env is dropped between stages) and
# nothing gets inlined into the bundle (these are all server-side reads via
# `process.env`, not `NEXT_PUBLIC_*`).
ENV DATABASE_URL=postgres://build:build@build-time-placeholder:5432/build
ENV BETTER_AUTH_SECRET=build-time-placeholder-not-used-at-runtime-xxxxx
ENV ELEVASPEED_INTEGRATION_API_KEY=build-time-placeholder-not-used-at-runtime-xxxxx

RUN pnpm build

# ---------- runner ----------
FROM node:${NODE_VERSION} AS runner
WORKDIR /app

ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1
ENV PORT=3000
ENV HOSTNAME=0.0.0.0

# Non-root runtime user
RUN addgroup -g 1001 -S nextjs \
 && adduser  -S -u 1001 -G nextjs nextjs

# Copy standalone server + the public + static assets it expects
COPY --from=builder --chown=nextjs:nextjs /app/public ./public
COPY --from=builder --chown=nextjs:nextjs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nextjs /app/.next/static ./.next/static

# wget is part of busybox in node:alpine — used by the healthcheck below.
USER nextjs

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD wget --spider --quiet http://127.0.0.1:3000/api/health || exit 1

CMD ["node", "server.js"]