# --- Build stage ---
FROM node:24-slim AS build
WORKDIR /app

# Placeholder values for build-time $env/static/* and better-auth's module-scope
# secret validation. These are NOT the real runtime values — App Platform
# injects the real ones as env vars when the container runs.
ARG DATABASE_URL=postgres://placeholder:placeholder@localhost:5432/placeholder
ARG ORIGIN=http://localhost:3000
ARG BETTER_AUTH_URL=http://localhost:3000
ARG BETTER_AUTH_BASE_URL=http://localhost:3000
ARG BETTER_AUTH_SECRET=placeholder-build-time-secret-not-used-at-runtime
ENV DATABASE_URL=$DATABASE_URL
ENV ORIGIN=$ORIGIN
ENV BETTER_AUTH_URL=$BETTER_AUTH_URL
ENV BETTER_AUTH_BASE_URL=$BETTER_AUTH_BASE_URL
ENV BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET

COPY package*.json ./
RUN npm ci

COPY . .
RUN npm run build

# Drop devDependencies now that the build is done
RUN npm prune --omit=dev

# --- Runtime stage ---
FROM node:24-slim AS runtime
WORKDIR /app
ENV NODE_ENV=production
ENV PORT=3000

# Install the DigitalOcean managed DB CA cert into the system trust store.
# `ca-certificates` provides update-ca-certificates; certs placed in
# /usr/local/share/ca-certificates/ must end in .crt to be picked up.
COPY digital-ocean.crt /usr/local/share/ca-certificates/digital-ocean.crt
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && update-ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Node still doesn't read the system trust store unless --use-system-ca is
# passed explicitly (available on 22.19+/24.6+, but off by default even here).
# NODE_EXTRA_CA_CERTS is simpler and works regardless of Node version.
ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/digital-ocean.crt

COPY --from=build /app/build ./build
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/package.json ./package.json
COPY --from=build /app/node_modules/.prisma ./node_modules/.prisma
COPY --from=build /app/src/lib/generated/prisma ./src/lib/generated/prisma
COPY --from=build /app/prisma ./prisma
COPY --from=build /app/prisma.config.ts ./prisma.config.ts
COPY docker-entrypoint.sh ./

EXPOSE 3000
CMD ["./docker-entrypoint.sh"]