Dockerfile.prod

# Production Dockerfile for Familiarise
# Multi-stage build for optimal image size

# Stage 1: Dependencies
FROM node:22-alpine AS deps
RUN apk add --no-cache libc6-compat python3 make g++
WORKDIR /app

# `.npmrc` comes along so the image resolves dependencies as local/CI do. It
# no longer sets legacy-peer-deps — the better-call zod@^4 vs zod@3 conflict
# is pinned by `overrides` in package.json instead.
# Schema before install: package.json's `postinstall` runs `prisma generate`,
# which fails with "Could not find Prisma Schema" if the schema lands after.
COPY prisma ./prisma/
COPY package.json package-lock.json .npmrc ./
# `--ignore-scripts` then the one script we actually want, run explicitly —
# see the Dockerfile for the reasoning (sonar docker:S6505).
RUN npm ci --ignore-scripts && ./node_modules/.bin/prisma generate

# Stage 2: Builder
FROM node:22-alpine AS builder
RUN apk add --no-cache libc6-compat
WORKDIR /app

COPY package.json package-lock.json .npmrc ./
COPY --from=deps /app/node_modules ./node_modules

COPY prisma ./prisma/
# Local binary, not `npx`: npx may resolve and execute a package from the
# registry on demand, and at whatever version it finds (docker:S6505,
# docker:S8543). node_modules is copied from the deps stage above, so the
# pinned prisma 7.7.0 is already here.
RUN ./node_modules/.bin/prisma generate

COPY . .

# Build arguments for environment variables needed at build time
ARG NEXT_PUBLIC_SUPABASE_URL
ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
ARG NEXT_PUBLIC_STREAM_API_KEY
ARG NEXT_PUBLIC_SENTRY_DSN

ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL
ENV NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY
ENV NEXT_PUBLIC_STREAM_API_KEY=$NEXT_PUBLIC_STREAM_API_KEY
ENV NEXT_PUBLIC_SENTRY_DSN=$NEXT_PUBLIC_SENTRY_DSN

# Build the application
ENV NODE_ENV=production
RUN npm run build

# Stage 3: Runner
FROM node:22-alpine AS runner
WORKDIR /app

ENV NODE_ENV=production

# Create non-root user for security
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

# Copy necessary files from builder
COPY --from=builder /app/public ./public
COPY --from=builder /app/package.json ./package.json
COPY --from=builder /app/.next ./.next
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/next.config.mjs ./next.config.mjs
COPY --from=builder /app/prisma ./prisma

# Set correct permissions
RUN chown -R nextjs:nodejs /app

USER nextjs

EXPOSE 3000

ENV PORT=3000
ENV HOSTNAME="0.0.0.0"

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1

CMD ["npm", "start"]