# MAGIK — Commander deck builder.
#
# Two stages. The build stage needs pnpm, the Vite toolchain and TypeScript;
# the runtime stage carries only the built SPA, the API and its SQLite index,
# so nothing that only matters at build time reaches the cluster.
#
# data/cards.db is produced by scripts/build-cards.mjs rather than here: the
# Scryfall bulk download is cached on the host, and building the image does not
# need network access to Scryfall. scripts/deploy.sh builds it first if missing.

FROM node:26-alpine AS build
# Node 26 ships without corepack, so pnpm is installed the ordinary way and
# pinned to the major the lockfile was written with.
RUN npm install -g pnpm@11
WORKDIR /src

# Dependencies are installed from the lockfile alone so this layer is reused
# whenever only application source changes.
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
RUN pnpm install --frozen-lockfile

COPY index.html tsconfig.json vite.config.ts ./
COPY public/ public/
COPY src/ src/
RUN pnpm build

FROM node:26-alpine AS runtime
# 10001 matches the runAsUser in deploy/k8s/magic.yaml. The server opens the
# SQLite file read-only, so it never needs write access to its own directory.
RUN adduser -D -u 10001 app
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build /src/dist ./dist
COPY server/ ./server/
COPY data/cards.db ./data/cards.db
USER 10001
EXPOSE 8080
CMD ["node", "server/index.mjs"]
