# Production image for the Next.js frontend - built with `next build`
# (output: "standalone" in next.config.js), served with `node server.js`,
# not `next dev`/`npm start`. See infrastructure/docker/web.Dockerfile for
# the dev image (kept separate and untouched).

FROM node:20-alpine AS deps
WORKDIR /app
COPY apps/web/package.json apps/web/package-lock.json* ./
RUN npm ci


FROM node:20-alpine AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY apps/web ./
# Baked into the browser bundle at build time - must be the public URL the
# *browser* will use, not a Docker-internal service name. See .env.example.
ARG NEXT_PUBLIC_API_URL
ARG NEXT_PUBLIC_GIT_REPO_URL
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL} \
    NEXT_PUBLIC_GIT_REPO_URL=${NEXT_PUBLIC_GIT_REPO_URL}
RUN npm run build


FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjs

# output:"standalone" already traces only the files actually needed at
# runtime - no full node_modules copy required.
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/.next/static ./.next/static
COPY --from=builder /app/public ./public

USER nextjs
EXPOSE 3000

CMD ["node", "server.js"]