# Step 1: Builder stage
FROM node:20-alpine AS builder
RUN apk add --no-cache libc6-compat curl
WORKDIR /app
RUN corepack enable pnpm

# Copy source (honoring .dockerignore)
COPY . .

# Use a secret for NPM_TOKEN to authenticate with private registry
RUN --mount=type=cache,target=/root/.local/share/pnpm/store/v3 \
    --mount=type=secret,id=NPM_TOKEN \
    export NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN) && \
    pnpm i --frozen-lockfile

# Build Gatekeeper
RUN pnpm --filter @mintel/gatekeeper build

# Step 2: Runner stage
FROM node:20-alpine AS runner
RUN apk add --no-cache libc6-compat curl
WORKDIR /app
ENV NODE_ENV=production
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

COPY --from=builder /app/packages/gatekeeper/public ./packages/gatekeeper/public
COPY --from=builder /app/packages/gatekeeper/.next/standalone ./
COPY --from=builder /app/packages/gatekeeper/.next/static ./packages/gatekeeper/.next/static

USER nextjs
EXPOSE 3000
ENV PORT=3000
ENV HOSTNAME="0.0.0.0"

CMD ["node", "packages/gatekeeper/server.js"]