FROM node:25-slim AS base
# curl is used by the docker-compose healthcheck (node:25-slim is Debian
# trixie-slim and ships neither curl nor wget by default).
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
RUN npm install -g pnpm@10.6.5
WORKDIR /app

FROM base AS deps
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY apps/planner/package.json apps/planner/
COPY packages/types/package.json packages/types/
COPY packages/ui/package.json packages/ui/
COPY packages/map/package.json packages/map/
COPY packages/gpx/package.json packages/gpx/
COPY packages/i18n/package.json packages/i18n/
COPY packages/sentry-config/package.json packages/sentry-config/
COPY packages/api/package.json packages/api/
COPY packages/map-core/package.json packages/map-core/
COPY packages/db/package.json packages/db/
COPY packages/jobs/package.json packages/jobs/
COPY packages/fit/package.json packages/fit/
RUN pnpm install --frozen-lockfile

FROM base AS build
ARG SENTRY_RELEASE
COPY --from=deps /app/ ./
COPY . .
RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
    SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null | tr -d '\n\r')" \
    SENTRY_RELEASE="$SENTRY_RELEASE" \
    pnpm --filter @trails-cool/planner build

FROM base AS runtime
RUN addgroup --system app && adduser --system --ingroup app app
COPY --from=deps /app/node_modules ./node_modules
COPY --from=deps /app/apps/planner/node_modules ./apps/planner/node_modules
COPY --from=build /app/apps/planner/build ./apps/planner/build
COPY --from=build /app/apps/planner/server.ts ./apps/planner/server.ts
COPY --from=build /app/apps/planner/app/lib ./apps/planner/app/lib
COPY --from=build /app/apps/planner/app/jobs ./apps/planner/app/jobs
COPY --from=build /app/apps/planner/package.json ./apps/planner/package.json
COPY --from=build /app/packages ./packages

WORKDIR /app/apps/planner
USER app
EXPOSE 3001
ENV PORT=3001
CMD ["node", "--experimental-strip-types", "server.ts"]