# Build from repository root (see docker-compose `context: .`).
FROM node:20-alpine AS builder

WORKDIR /app

ARG NEXT_PUBLIC_API_URL=http://localhost:8000
ARG NEXT_PUBLIC_APP_URL=http://localhost:3000
ARG NEXT_PUBLIC_SITE_URL=http://localhost:3001
# Auth is ON by default. Local development can override with
# `--build-arg NEXT_PUBLIC_AUTH_ENABLED=false`. Any production / staging /
# private-preview deploy must keep this true. Defense-in-depth at the edge
# is also available via DASHBOARD_BASIC_AUTH_USER / _PASSWORD (see middleware.ts).
ARG NEXT_PUBLIC_AUTH_ENABLED=true

COPY package.json package-lock.json ./
COPY apps/dashboard/package.json apps/dashboard/
COPY apps/site/package.json apps/site/

RUN npm ci

COPY apps/dashboard ./apps/dashboard

WORKDIR /app/apps/dashboard
ENV NEXT_TELEMETRY_DISABLED=1
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
ENV NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL}
ENV NEXT_PUBLIC_AUTH_ENABLED=${NEXT_PUBLIC_AUTH_ENABLED}
RUN npm run build

FROM node:20-alpine

WORKDIR /app

ARG NEXT_PUBLIC_API_URL=http://localhost:8000
ARG NEXT_PUBLIC_APP_URL=http://localhost:3000
ARG NEXT_PUBLIC_SITE_URL=http://localhost:3001
# Production runtime mirrors the build-time default: auth is ON unless the
# operator explicitly disables it. Pair with DASHBOARD_BASIC_AUTH_USER /
# DASHBOARD_BASIC_AUTH_PASSWORD for an edge-level Basic Auth gate.
ARG NEXT_PUBLIC_AUTH_ENABLED=true

COPY --from=builder /app/apps/dashboard/.next/standalone ./
COPY --from=builder /app/apps/dashboard/.next/static ./apps/dashboard/.next/static

EXPOSE 3000

ENV HOSTNAME="0.0.0.0"
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
ENV NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
ENV NEXT_PUBLIC_SITE_URL=${NEXT_PUBLIC_SITE_URL}
ENV NEXT_PUBLIC_AUTH_ENABLED=${NEXT_PUBLIC_AUTH_ENABLED}
CMD ["node", "apps/dashboard/server.js"]
