FROM node:22-alpine AS frontend
WORKDIR /app/frontend
COPY frontend/package*.json ./
RUN npm ci
COPY frontend/ ./
RUN npm run build

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src
COPY src/Tau.Acuvim.Portal/Tau.Acuvim.Portal.csproj ./Tau.Acuvim.Portal/
RUN dotnet restore Tau.Acuvim.Portal/Tau.Acuvim.Portal.csproj
COPY src/Tau.Acuvim.Portal/ ./Tau.Acuvim.Portal/
RUN dotnet publish Tau.Acuvim.Portal/Tau.Acuvim.Portal.csproj \
    -c Release -o /app/publish /p:UseAppHost=false

FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
WORKDIR /app

# Npgsql probes for Kerberos auth on Linux and logs a noisy "Cannot load library
# libgssapi_krb5.so.2" error if missing. Installing the lib silences the warning;
# we don't actually use Kerberos auth.
RUN apt-get update \
 && apt-get install -y --no-install-recommends libgssapi-krb5-2 \
 && rm -rf /var/lib/apt/lists/*

COPY --from=build /app/publish .
COPY --from=frontend /app/frontend/dist ./wwwroot/

RUN mkdir -p /data/keys /data/branding && \
    chown -R app:app /data
USER app

ENV ASPNETCORE_URLS=http://+:8080
EXPOSE 8080

ENTRYPOINT ["dotnet", "Tau.Acuvim.Portal.dll"]