# 多阶段构建：Node 构建前端 → Go 编译（嵌入前端）→ distroless static nonroot。
# 镜像名 git.asio.asia/nixevol/nixmsg；入口 /nixmsg。
# 单架构：task q:docker-build 或 q:docker-push（含推送）。
# 多架构：task q:docker-buildx（linux/amd64 + linux/arm64，需 buildx；正式推送在 Z3）。

FROM node:24-bookworm AS web
WORKDIR /src/web
COPY web/package.json web/pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile
COPY web/ ./
RUN pnpm build

FROM golang:1.27-bookworm AS build
ARG TARGETOS=linux
ARG TARGETARCH=amd64
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=web /src/web/dist ./web/dist
ENV CGO_ENABLED=0
RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -tags embeddist -o /out/nixmsg ./cmd/nixmsg

FROM gcr.io/distroless/static:nonroot
COPY --from=build /out/nixmsg /nixmsg
USER nonroot:nonroot
ENTRYPOINT ["/nixmsg"]
CMD ["serve"]