# syntax=docker/dockerfile:1
# libreDecision v3 — one image: the Rust server serves the API and the compiled
# Svelte interface. Every gate of the loop runs inside the build: a red check
# means no image.

# --- Interface -----------------------------------------------------------------
FROM node:22-bookworm-slim AS web
WORKDIR /src/web
COPY web/package.json web/package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY web/ ./
ARG LD_BUILD=dev
ENV LD_BUILD=${LD_BUILD}
RUN npx svelte-kit sync \
 && npx svelte-check --tsconfig ./tsconfig.json --fail-on-warnings \
 && npx vitest run \
 && npx vite build

# --- Server --------------------------------------------------------------------
FROM rust:1.99-slim-bookworm AS server
RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*
WORKDIR /src
COPY rust-toolchain.toml ./
RUN rustup show active-toolchain || rustup toolchain install
COPY Cargo.toml Cargo.lock rustfmt.toml ./
COPY crates crates
COPY seeds seeds
RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/src/target \
    cargo fmt --all --check \
 && cargo clippy --workspace --all-targets --locked -- -D warnings \
 && cargo test --workspace --locked \
 && cargo build --release --locked -p ld-server \
 && cp target/release/ld-server /usr/local/bin/ld-server

# --- Runtime -------------------------------------------------------------------
FROM debian:bookworm-slim AS production
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates git openssh-client tini \
 && rm -rf /var/lib/apt/lists/* \
 && useradd --system --uid 10001 --create-home --home-dir /home/app app \
 && mkdir -p /data && chown app:app /data
COPY --from=server /usr/local/bin/ld-server /usr/local/bin/ld-server
COPY --from=web /src/web/build /app/web
COPY seeds /app/seeds
ARG LD_BUILD=dev
ENV LD_BUILD=${LD_BUILD} \
    LD_BIND=0.0.0.0:8002 \
    LD_DATA_DIR=/data \
    LD_WEB_DIR=/app/web \
    LD_SEED_DIR=/app/seeds
USER app
EXPOSE 8002
VOLUME /data
ENTRYPOINT ["tini", "--"]
CMD ["ld-server"]