neiam /fieri-forever

# Multi-stage build: compile assets, build the Rust binaries, ship a slim
# runtime. Kept BuildKit-optional so it also works under Kaniko/podman.

# --------------------------------------------------------------------------
# Stage 1 — assets: Tailwind CSS + esbuild JS bundle + FontAwesome webfonts.
# --------------------------------------------------------------------------
FROM node:20-alpine AS assets
WORKDIR /app
COPY assets/package.json ./assets/
RUN cd assets && npm install --no-audit --no-fund

COPY assets/tailwind.config.js ./assets/
COPY assets/f ./assets/f
COPY templates ./templates

RUN cd assets \
 && ./node_modules/.bin/tailwindcss -c tailwind.config.js -i f/css/style.css -o f/css/app.css \
 && ./node_modules/.bin/esbuild f/js/src.js --bundle --minify --outfile=f/js/app.js \
 && mkdir -p f/webfonts \
 && cp node_modules/@fortawesome/fontawesome-free/webfonts/*.woff2 f/webfonts/ \
 && cp node_modules/@fortawesome/fontawesome-free/webfonts/*.ttf  f/webfonts/

# --------------------------------------------------------------------------
# Stage 2 — rust-builder: build the release binaries.
# --------------------------------------------------------------------------
FROM rust:1.98-bookworm AS rust-builder
WORKDIR /app
RUN apt-get update \
 && apt-get install -y --no-install-recommends pkg-config libssl-dev ca-certificates \
 && rm -rf /var/lib/apt/lists/*

# Cargo.lock is committed: an app's image should build the same crates every
# time, not whatever resolved on the day.
COPY Cargo.toml Cargo.lock build.rs ./
COPY migration/Cargo.toml migration/
COPY migration/src migration/src
COPY src src
COPY templates templates
COPY --from=assets /app/assets/f ./assets/f

RUN cargo build --release --locked --bin webservice --bin registration-token \
 && mkdir -p /out \
 && cp target/release/webservice        /out/app-webservice \
 && cp target/release/registration-token /out/app-registration-token

# --------------------------------------------------------------------------
# Stage 3 — runtime: slim Debian with the binaries, assets, and templates.
# --------------------------------------------------------------------------
FROM debian:bookworm-slim AS runtime
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates libssl3 \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd --system --gid 10001 app \
 && useradd  --system --uid 10001 --gid app --home /app --shell /usr/sbin/nologin app \
 && mkdir -p /app && chown -R app:app /app

WORKDIR /app
COPY --from=rust-builder /out/app-webservice         /usr/local/bin/app-webservice
COPY --from=rust-builder /out/app-registration-token /usr/local/bin/app-registration-token
COPY --from=assets       /app/assets/f               /app/assets/f
COPY --chown=app:app     templates                   /app/templates

USER app

ENV BIND_ADDRESS=0.0.0.0:3999 \
    AUTO_MIGRATE=true \
    REGISTRATION_ENABLED=false

EXPOSE 3999

# `... app-webservice`          → web (default)
# `... app-registration-token`  → invite CLI
CMD ["app-webservice"]