# Multi-stage production image for StrataX control plane.
# Solvers (Kissat/CaDiCaL/DRAT) are copied as user-connectable open-source
# binaries — StrataX does not claim ownership of those projects.
# Final image runs as non-root on port 8080.

# ── deps ────────────────────────────────────────────────────────────────────
FROM node:22-bookworm-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev=false

# ── build ───────────────────────────────────────────────────────────────────
FROM node:22-bookworm-slim AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
ENV NODE_ENV=production
RUN npm run build

# ── runtime ─────────────────────────────────────────────────────────────────
FROM node:22-bookworm-slim AS runtime
WORKDIR /app

RUN groupadd --system stratax && useradd --system --gid stratax --home /app stratax \
  && apt-get update \
  && apt-get install -y --no-install-recommends ca-certificates curl \
  && rm -rf /var/lib/apt/lists/*

ENV NODE_ENV=production \
    PORT=8080 \
    HOST=0.0.0.0 \
    STRATAX_PUBLIC_READY=false \
    STRATAX_PAYOUT_ENABLED=false \
    STRATAX_BILLING_ENABLED=false \
    STRATAX_BOUNTY_LEGAL_GO=false \
    STRATAX_CHECKER_FAIL_CLOSED=true \
    STRATAX_SOLVER_PATH=/app/bin \
    PATH=/app/bin:$PATH

COPY --from=build /app/package.json ./package.json
COPY --from=build /app/package-lock.json ./package-lock.json
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/.output ./.output
COPY --from=build /app/dist ./dist
COPY --from=build /app/migrations ./migrations
COPY --from=build /app/scripts ./scripts
COPY --from=build /app/public ./public
COPY --from=build /app/bin ./bin
COPY --from=build /app/startup.sh ./startup.sh

RUN chmod +x /app/startup.sh /app/bin/* 2>/dev/null || true \
  && chown -R stratax:stratax /app

USER stratax
EXPOSE 8080

# Graceful signal forwarding is handled by Node; no shell wrapper.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD curl -sf http://127.0.0.1:8080/api/v1/health || exit 1

CMD ["npm", "run", "preview"]
