# --- Dev stage ---
FROM node:22-alpine AS dev
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
EXPOSE 5173
# Invoke vite directly rather than through `npm run`: under `docker compose
# up -d` (no TTY, no stdin) the npm wrapper printed its banner and exited 0
# immediately, so the dev server never came up.
CMD ["node", "node_modules/vite/bin/vite.js", "--host"]

# --- Build stage ---
# No VITE_API_URL build arg: the production image uses runtime config (/config.js)
# rendered at container startup. See docker/40-render-config.sh.
FROM node:22-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# --- Production stage ---
# nginx-unprivileged rather than nginx: the stock image runs its master process
# as root, which this container has no need for - it serves static files. It
# listens on 8080 because a non-root process cannot bind a privileged port
# without CAP_NET_BIND_SERVICE, and that capability is dropped in compose.
FROM nginxinc/nginx-unprivileged:alpine AS production

# Package upgrades and directory ownership need root; the image drops back to
# its unprivileged user before nginx starts.
USER root
# Pull current security fixes for OS packages inherited from the base image
# (e.g. nghttp2-libs CVE-2026-27135). envsubst is no longer installed:
# 40-render-config.sh writes config.js itself so it can escape the value, which
# envsubst cannot do.
RUN apk upgrade --no-cache

COPY --from=build /app/dist /usr/share/nginx/html
# The CSP hash tokens for index.html's inline scripts, produced by `npm run
# build` from the shipped file. Outside the web root: it belongs to the
# server configuration, not the site.
COPY --from=build /app/build/csp-inline-script-hashes /etc/nginx/csp-inline-script-hashes
COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY docker/40-render-config.sh /docker-entrypoint.d/40-render-config.sh

# The entrypoint script writes config.js and the security-header snippet at
# start-up, so both destinations must be writable by the unprivileged user.
# 101 is the nginx uid/gid in this image.
RUN chmod +x /docker-entrypoint.d/40-render-config.sh  && mkdir -p /etc/nginx/snippets  && chown -R 101:101 /usr/share/nginx/html /etc/nginx/snippets

USER 101
EXPOSE 8080
# The upstream entrypoint runs /docker-entrypoint.d/*.sh then launches nginx.
