FROM node:22-bookworm-slim AS ui

WORKDIR /src/apps

RUN corepack enable && corepack prepare pnpm@10.30.3 --activate

COPY apps/package.json apps/pnpm-lock.yaml apps/pnpm-workspace.yaml ./
COPY apps/components.json apps/next.config.ts ./
COPY apps/postcss.config.mjs apps/tsconfig.json ./
COPY apps/public ./public
COPY apps/src ./src

RUN pnpm install --frozen-lockfile && pnpm run build

FROM rust:1-bookworm AS builder

WORKDIR /src

COPY Cargo.toml Cargo.lock ./
COPY crates ./crates

COPY --from=ui /src/apps/out ./apps/out

RUN cargo build --locked -p codexmanager-web --release --features embedded-ui

FROM debian:bookworm-slim

ARG APP_USER=codexmanager
ARG APP_UID=10001

ENV TZ=Asia/Shanghai

WORKDIR /app

RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates wget tzdata \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid ${APP_UID} ${APP_USER} \
    && useradd --uid ${APP_UID} --gid ${APP_UID} --home-dir /app --no-create-home --shell /usr/sbin/nologin ${APP_USER} \
    && mkdir -p /data \
    && chown -R ${APP_UID}:${APP_UID} /app /data

COPY --from=builder /src/target/release/codexmanager-web /usr/local/bin/codexmanager-web

ENV CODEXMANAGER_WEB_ADDR=0.0.0.0:48761
ENV CODEXMANAGER_WEB_NO_SPAWN_SERVICE=1
ENV CODEXMANAGER_WEB_NO_OPEN=1
# 默认值适配 docker-compose 的服务名；单独运行时可覆盖为外部 service 的地址。
ENV CODEXMANAGER_SERVICE_ADDR=codexmanager-service:48760
ENV CODEXMANAGER_DB_PATH=/data/codexmanager.db
ENV CODEXMANAGER_RPC_TOKEN_FILE=/data/codexmanager.rpc-token

VOLUME ["/data"]
EXPOSE 48761

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:48761/__auth_status || exit 1

USER ${APP_USER}

CMD ["codexmanager-web"]