FROM node:24-alpine AS base
RUN corepack enable && corepack prepare pnpm@10.13.1 --activate
WORKDIR /app

FROM base AS dependencies
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

FROM base AS production-dependencies
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --prod --frozen-lockfile

FROM dependencies AS builder
COPY . .
# Next evaluates route modules while building. These inert values only satisfy
# configuration parsing at build time; Compose/runtime values replace them.
ENV APP_URL=http://build.local \
    DATABASE_URL=postgresql://build:build@localhost:5432/build \
    BETTER_AUTH_SECRET=build-only-secret-that-is-at-least-thirty-two-characters \
    BETTER_AUTH_URL=http://build.local
RUN pnpm build

FROM node:24-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production PORT=3000 HOSTNAME=0.0.0.0
RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 beacon
COPY --from=builder /app/public ./public
COPY --from=builder --chown=beacon:nodejs /app/.next/standalone ./
COPY --from=builder --chown=beacon:nodejs /app/.next/static ./.next/static
COPY --from=builder --chown=beacon:nodejs /app/drizzle ./drizzle
COPY --from=builder --chown=beacon:nodejs /app/scripts ./scripts
COPY --from=production-dependencies --chown=beacon:nodejs /app/node_modules ./node_modules
USER beacon
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD node -e "fetch('http://localhost:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
ENTRYPOINT ["/bin/sh", "./scripts/entrypoint.sh"]