# syntax=docker/dockerfile:1.7

FROM node:24-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f AS frontend
WORKDIR /src
COPY package.json package-lock.json ./
RUN npm ci
COPY assets ./assets
RUN npm run build

FROM composer:2.8@sha256:5248900ab8b5f7f880c2d62180e40960cd87f60149ec9a1abfd62ac72a02577c AS vendor
WORKDIR /src
COPY composer.json composer.lock symfony.lock ./
RUN composer install \
    --no-dev \
    --no-interaction \
    --no-progress \
    --no-scripts \
    --optimize-autoloader \
    --prefer-dist \
    --ignore-platform-req=ext-intl \
    --ignore-platform-req=ext-pdo_pgsql

FROM php:8.4.27-fpm-alpine@sha256:6b83fd767e1902ae4c89fe11f929f02e78bf769215c703060ac8a7c4be672c8c AS app
WORKDIR /var/www/html

RUN apk add --upgrade --no-cache 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0' \
    && apk add --no-cache icu-libs libpq libzip \
    && apk add --no-cache --virtual .build-deps $PHPIZE_DEPS icu-dev postgresql-dev libzip-dev \
    && docker-php-ext-configure intl \
    && docker-php-ext-install -j"$(nproc)" intl opcache pcntl pdo_pgsql zip \
    && apk del .build-deps

COPY --chown=www-data:www-data . ./
COPY --from=vendor --chown=www-data:www-data /src/vendor ./vendor
COPY --from=frontend --chown=www-data:www-data /src/public/assets ./public/assets
COPY ops/php.ini /usr/local/etc/php/conf.d/etza-poll.ini
COPY ops/app-entrypoint.sh /usr/local/bin/etza-poll-entrypoint

RUN chmod 755 /usr/local/bin/etza-poll-entrypoint \
    && mkdir -p var/cache var/log var/share \
    && chown -R www-data:www-data var \
    && php -r 'require "vendor/autoload.php"; foreach (["App\\Service\\DeletionJournal", "App\\Service\\ContactStore", "App\\Service\\LocalSlotTime", "App\\Controller\\SourceController", "App\\Command\\PrivacyReplayCommand"] as $class) { if (!class_exists($class)) { throw new RuntimeException("Incomplete application image"); } } if (!extension_loaded("sodium")) { throw new RuntimeException("Missing contact encryption extension"); }'

ENTRYPOINT ["etza-poll-entrypoint"]
USER www-data
CMD ["php-fpm"]

FROM nginxinc/nginx-unprivileged:1.30.6-alpine@sha256:f5116ed4606f3eb015dd4a8e28cb9b351476dc0ad4bc6e9f93b19cec130cdf03 AS web
USER root
RUN apk add --upgrade --no-cache 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0'
USER 101
COPY ops/nginx.conf /etc/nginx/conf.d/default.conf
COPY public /var/www/html/public
COPY --from=frontend /src/public/assets /var/www/html/public/assets

# Run directly as postgres; the upstream gosu privilege-switch helper is unused.
FROM postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea AS database
RUN rm -f /usr/local/bin/gosu /usr/local/bin/su-exec
USER postgres
