# The runtime receives credentials from Coolify; no secrets are build arguments.
FROM node:24.18.1-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS build
RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates python3 make g++ cmake fonts-freefont-ttf && rm -rf /var/lib/apt/lists/*
WORKDIR /app
# The monorepo's type checker exceeds Node's default 2 GiB heap on smaller builders.
ENV HUSKY=0 DOCKER_OUTPUT=1 DOCUMENSO_DISABLE_TELEMETRY=true NODE_OPTIONS=--max-old-space-size=4096
COPY . .
RUN npm ci --no-audit --no-fund
RUN npm run prisma:generate -w @documenso/prisma
RUN npm run build -w @documenso/remix
RUN sh scripts/ibp/source-archive.sh

FROM node:24.18.1-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS runtime
RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates fonts-freefont-ttf ghostscript default-jre-headless curl unzip && rm -rf /var/lib/apt/lists/*
COPY scripts/ibp/pdfa/install-verapdf.sh /tmp/install-verapdf.sh
RUN sh /tmp/install-verapdf.sh && rm /tmp/install-verapdf.sh
ENV IBP_VERAPDF_BIN=/opt/verapdf/verapdf IBP_PDFA_ICC_PATH=/usr/share/color/icc/ghostscript/srgb.icc
ENV NODE_ENV=production PORT=3000 DOCUMENSO_DISABLE_TELEMETRY=true HUSKY=0
WORKDIR /app
COPY --from=build --chown=node:node /app /app
USER node
WORKDIR /app/apps/remix
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=5 CMD node -e "fetch('http://127.0.0.1:3000/api/ibp/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["sh", "/app/scripts/ibp/start.sh"]
