# =============================================================================
# DCTS Server Dockerfile — Multi-stage Build (Server + Frontend Dashboard)
# =============================================================================

# ─── Stage 1: 前端静态资源构建 ────────────────────────────────────────────────
FROM node:22-alpine AS frontend-builder

ARG USE_MIRRORS=1
WORKDIR /app/dashboard

RUN if [ "$USE_MIRRORS" = "1" ]; then \
      npm config set registry https://registry.npmmirror.com; \
    fi

COPY dashboard/package.json dashboard/package-lock.json* ./
RUN npm install
COPY dashboard/ ./
RUN npm run build

# ─── Stage 2: Rust 服务端编译 (Alpine/musl 静态编译) ─────────────────────────
FROM rust:1.94-alpine AS backend-builder

ARG USE_MIRRORS=1

RUN if [ "$USE_MIRRORS" = "1" ]; then \
      sed -i 's|dl-cdn.alpinelinux.org|mirrors.aliyun.com|g' /etc/apk/repositories; \
    fi

RUN apk add --no-cache musl-dev g++ make cmake pkgconfig sqlite-dev openssl-dev openssl-libs-static

WORKDIR /app
ENV SKIP_DASHBOARD_BUILD=1

COPY Cargo.toml Cargo.lock ./
COPY crates/ ./crates/
COPY tools/ ./tools/
COPY assets/tlusty_static assets/synspec_static ./assets/
COPY --from=frontend-builder /app/dashboard/dist ./dashboard/dist

RUN cargo build --release -p server && \
    cp /app/target/release/server /usr/local/bin/dcts-server

# ─── Stage 3: 最小化生产运行镜像 ─────────────────────────────────────────────
FROM alpine:3.21

ARG USE_MIRRORS=1

RUN if [ "$USE_MIRRORS" = "1" ]; then \
      sed -i 's|dl-cdn.alpinelinux.org|mirrors.aliyun.com|g' /etc/apk/repositories; \
    fi

RUN apk add --no-cache ca-certificates tzdata sqlite

# 创建非 root 账号管理运行
RUN addgroup -g 65532 -S dcts && adduser -u 65532 -S dcts -G dcts

WORKDIR /app

COPY --from=backend-builder /usr/local/bin/dcts-server /app/
COPY --from=frontend-builder /app/dashboard/dist ./dashboard/dist

RUN mkdir -p /app/data /app/data/results /app/logs /app/assets && \
    chown -R dcts:dcts /app

USER dcts

EXPOSE 8090

ENV DCTS_PORT=8090
ENV DCTS_DB_PATH=/app/data/dcts.db
ENV DCTS_QUEUE_DB_PATH=/app/data/dcts_queue.db
ENV DCTS_RESULTS_DIR=/app/data/results
ENV DCTS_BACKUP_DIR=/app/data/backups
ENV DCTS_ASSETS_DIR=/app/assets

VOLUME ["/app/data", "/app/logs"]

# 健康检查走不走鉴权的 /healthz（启用 admin/enrollment token 后 /api/status 返回 401，
# 会令容器被误判不健康而反复重启）。与 docker-compose.yml 的 healthcheck 保持一致。
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
    CMD wget -q --spider http://localhost:8090/healthz || exit 1

ENTRYPOINT ["/app/dcts-server"]