# 多阶段构建：Node 构建前端 → Go 编译（嵌入前端）→ distroless static nonroot。
# 镜像名 git.asio.asia/nixevol/nixmsg；多架构 buildx 推送留给 Q4 定稿，本骨架先单架构可构建。

FROM node:24-bookworm AS web
WORKDIR /src/web
COPY web/package.json web/pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile
COPY web/ ./
RUN pnpm build

FROM golang:1.27-bookworm AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=web /src/web/dist ./web/dist
ENV CGO_ENABLED=0
RUN go build -tags embeddist -o /out/nixmsg ./cmd/nixmsg

FROM gcr.io/distroless/static:nonroot
COPY --from=build /out/nixmsg /nixmsg
USER nonroot:nonroot
ENTRYPOINT ["/nixmsg"]
CMD ["serve"]