FROM node:22-bookworm-slim AS frontend-builder

ARG BUILD_HTTP_PROXY=""
ARG BUILD_HTTPS_PROXY=""
ARG BUILD_ALL_PROXY=""

ENV HTTP_PROXY=${BUILD_HTTP_PROXY} \
    HTTPS_PROXY=${BUILD_HTTPS_PROXY} \
    ALL_PROXY=${BUILD_ALL_PROXY} \
    http_proxy=${BUILD_HTTP_PROXY} \
    https_proxy=${BUILD_HTTPS_PROXY} \
    all_proxy=${BUILD_ALL_PROXY}

WORKDIR /build/frontend
RUN npm install --global pnpm@10.28.0
COPY frontend/package.json frontend/pnpm-lock.yaml frontend/pnpm-workspace.yaml ./
RUN pnpm install --frozen-lockfile
COPY frontend/ ./
RUN pnpm build

FROM node:22-bookworm-slim AS bitwarden-builder

ARG BUILD_HTTP_PROXY=""
ARG BUILD_HTTPS_PROXY=""
ARG BUILD_ALL_PROXY=""

ENV HTTP_PROXY=${BUILD_HTTP_PROXY} \
    HTTPS_PROXY=${BUILD_HTTPS_PROXY} \
    ALL_PROXY=${BUILD_ALL_PROXY} \
    http_proxy=${BUILD_HTTP_PROXY} \
    https_proxy=${BUILD_HTTPS_PROXY} \
    all_proxy=${BUILD_ALL_PROXY}

RUN npm install --global --omit=dev @bitwarden/cli@2026.7.0

FROM ghcr.io/astral-sh/uv:0.8.4-python3.12-bookworm-slim AS backend-builder

ARG BUILD_HTTP_PROXY=""
ARG BUILD_HTTPS_PROXY=""
ARG BUILD_ALL_PROXY=""

ENV UV_LINK_MODE=copy \
    UV_PROJECT_ENVIRONMENT=/opt/venv \
    HTTP_PROXY=${BUILD_HTTP_PROXY} \
    HTTPS_PROXY=${BUILD_HTTPS_PROXY} \
    ALL_PROXY=${BUILD_ALL_PROXY} \
    http_proxy=${BUILD_HTTP_PROXY} \
    https_proxy=${BUILD_HTTPS_PROXY} \
    all_proxy=${BUILD_ALL_PROXY}

WORKDIR /build/backend
COPY backend/pyproject.toml backend/uv.lock backend/README.md ./
COPY backend/src ./src
RUN uv sync --locked --no-dev --no-editable

FROM python:3.12-slim-bookworm

ARG UID=1000
ARG GID=1000
ARG BUILD_HTTP_PROXY=""
ARG BUILD_HTTPS_PROXY=""
ARG BUILD_ALL_PROXY=""
ARG BUILD_APT_MIRROR=""

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PATH=/opt/venv/bin:$PATH \
    MEMRELAY_DATA_DIR=/data/memrelay \
    MEMRELAY_FRONTEND_DIR=/app/frontend \
    BITWARDENCLI_APPDATA_DIR=/data/memrelay/bitwarden \
    HTTP_PROXY="" \
    HTTPS_PROXY="" \
    ALL_PROXY="" \
    http_proxy="" \
    https_proxy="" \
    all_proxy="" \
    NO_PROXY="basic-memory,localhost,127.0.0.1"

RUN HTTP_PROXY="$BUILD_HTTP_PROXY" \
    HTTPS_PROXY="$BUILD_HTTPS_PROXY" \
    ALL_PROXY="$BUILD_ALL_PROXY" \
    http_proxy="$BUILD_HTTP_PROXY" \
    https_proxy="$BUILD_HTTPS_PROXY" \
    all_proxy="$BUILD_ALL_PROXY" \
    sh -c 'if [ -n "$BUILD_APT_MIRROR" ]; then sed -i "s|http://deb.debian.org|${BUILD_APT_MIRROR%/}|g" /etc/apt/sources.list.d/debian.sources; fi' \
    && \
    apt-get update \
    && apt-get install --yes --no-install-recommends \
        ca-certificates \
        git \
        gosu \
        libstdc++6 \
        openssh-client \
        poppler-utils \
        tesseract-ocr \
        tesseract-ocr-chi-sim \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid "$GID" appgroup \
    && useradd --uid "$UID" --gid "$GID" --create-home --shell /usr/sbin/nologin appuser \
    && mkdir -p /app/backend /app/frontend /data/memrelay \
    && chown -R appuser:appgroup /app /data

COPY --from=backend-builder /opt/venv /opt/venv
COPY backend/alembic.ini /app/backend/alembic.ini
COPY backend/migrations /app/backend/migrations
COPY --from=frontend-builder /build/frontend/dist /app/frontend
COPY --from=bitwarden-builder /usr/local/bin/node /usr/local/bin/node
COPY --from=bitwarden-builder /usr/local/lib/node_modules/@bitwarden/cli /usr/local/lib/node_modules/@bitwarden/cli
COPY deploy/memrelay/entrypoint.sh /usr/local/bin/memrelay-entrypoint
RUN ln -s /usr/local/lib/node_modules/@bitwarden/cli/build/bw.js /usr/local/bin/bw \
    && chmod +x /usr/local/bin/memrelay-entrypoint

WORKDIR /app/backend
USER root

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/api/v1/health/ready', timeout=3).read()" || exit 1

ENTRYPOINT ["memrelay-entrypoint"]
CMD ["uvicorn", "memrelay.app:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips", "*"]