FROM node:20-alpine AS webui-builder

WORKDIR /app/webui

COPY webui/package.json webui/pnpm-lock.yaml ./
RUN npm install -g pnpm && pnpm install --frozen-lockfile

COPY webui/ .
RUN pnpm build

FROM rust:1.89-alpine AS rust-builder

RUN apk add --no-cache musl-dev sqlite-dev pkgconfig openssl-dev

WORKDIR /app/server

COPY server/Cargo.toml server/Cargo.lock ./

COPY server/src ./src
RUN cargo build --release

FROM alpine:latest

RUN apk add --no-cache sqlite

RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup

WORKDIR /app

RUN mkdir -p data/db data/logs data/backups && \
    chown -R appuser:appgroup /app

COPY --from=rust-builder /app/server/target/release/server ./server

COPY --from=webui-builder /app/webui/dist ./dist

RUN chown -R appuser:appgroup /app

USER appuser

EXPOSE 8379

ENV RUST_LOG=info

VOLUME ["/app/data/db"]
VOLUME ["/app/data/logs"]
VOLUME ["/app/data/backups"]

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://localhost:8379/ || exit 1

CMD ["./server"]