FROM node:24-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS frontend-builder

WORKDIR /frontend

# GNU cp is needed only to collect third-party notices in the builder.
RUN apk add --no-cache coreutils

ENV NODE_ENV=production \
    NEXT_TELEMETRY_DISABLED=1 \
    BACKEND_INTERNAL_URL=http://127.0.0.1:8000 \
    NEXT_PUBLIC_API_BASE=/api

COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci --include=dev

COPY frontend/app ./app
COPY frontend/public ./public
COPY frontend/next-env.d.ts ./next-env.d.ts
COPY frontend/next.config.js ./next.config.js
COPY frontend/proxy.ts ./proxy.ts
COPY frontend/tsconfig.json ./tsconfig.json

# Keep dependency notices outside the traced bundle: file tracing deliberately
# omits many license files that still need to accompany redistributed packages.
RUN npm run build \
    && npm prune --omit=dev \
    && mkdir /licenses \
    && npm ls --omit=dev --all --json > /licenses/dependencies.json \
    && find node_modules -type f \
        \( -iname 'license*' -o -iname 'copying*' -o -iname 'notice*' -o -iname 'copyright*' \) \
        -exec cp --parents -t /licenses {} +

FROM python:3.14-alpine@sha256:016508ba505da24f7139765bc4bb669df4e88eb2f12eeadd571bf2f88d7533df AS runtime

WORKDIR /app

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    MAGENT_MANAGED_SECRETS=auto \
    SQLITE_PATH=/app/data/magent.db \
    API_DOCS_ENABLED=false \
    NODE_ENV=production \
    NEXT_TELEMETRY_DISABLED=1

# Keep curl for existing deployments that override the image healthcheck.
# Copy only Node's runtime binary: npm, headers and the NodeSource installer
# are build tools, not dependencies of the standalone frontend server.
RUN apk upgrade --no-cache \
    && apk add --no-cache curl libstdc++

COPY --from=frontend-builder /usr/local/bin/node /usr/local/bin/node
COPY --from=frontend-builder /usr/local/LICENSE /usr/local/share/doc/nodejs/LICENSE
RUN node --version

ARG MAGENT_UID=1000
ARG MAGENT_GID=1000
RUN addgroup -g ${MAGENT_GID} magent \
    && adduser -D -u ${MAGENT_UID} -G magent -s /sbin/nologin magent \
    && install -d -o magent -g magent -m 0700 /app/data \
    && install -d -o magent -g magent -m 0755 /app/frontend/.next/cache

COPY backend/requirements.txt docker/requirements-runtime.txt /tmp/requirements/
RUN pip install --no-cache-dir --no-compile \
        -r /tmp/requirements/requirements.txt \
        -r /tmp/requirements/requirements-runtime.txt \
    && pip uninstall -y pip \
    && rm /tmp/requirements/requirements.txt /tmp/requirements/requirements-runtime.txt \
    && rmdir /tmp/requirements

COPY --chown=magent:magent backend/app ./app
COPY --chown=magent:magent data/branding /app/data/branding

# Next's traced standalone output excludes the full dev/build dependency tree.
COPY --chown=magent:magent --from=frontend-builder /frontend/.next/standalone /app/frontend
COPY --chown=magent:magent --from=frontend-builder /frontend/.next/static /app/frontend/.next/static
COPY --chown=magent:magent --from=frontend-builder /frontend/public /app/frontend/public

COPY docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
COPY LICENSE /usr/share/licenses/magent/LICENSE
COPY --from=frontend-builder /licenses /usr/share/licenses/magent/frontend

LABEL org.opencontainers.image.title="Magent" \
      org.opencontainers.image.description="Self-hosted media requests, issues and viewing insights" \
      org.opencontainers.image.licenses="MIT"

USER magent:magent

EXPOSE 3000 8000

HEALTHCHECK --interval=30s --timeout=5s --start-period=45s --retries=3 \
    CMD curl --fail --silent --show-error --max-time 2 http://127.0.0.1:8000/health >/dev/null \
        && curl --fail --silent --show-error --max-time 2 http://127.0.0.1:3000/login >/dev/null \
        || exit 1

ENTRYPOINT ["python", "-m", "app.container_bootstrap"]
CMD ["/usr/local/bin/supervisord", "-c", "/etc/supervisor/conf.d/magent.conf"]