# NexWordX frontend — multi-stage image (CONTRACT §8).
# There is no .dockerignore on purpose: every COPY below names exactly what the build needs.
#
#   docker build -t nexwordx-frontend \
#     --build-arg NEXWORDX_WP_URL=https://wordpress.example.com \
#     --build-arg NEXWORDX_SITE_URL=https://www.example.com .
#   docker run -p 3000:3000 -e NEXWORDX_SECRET=… nexwordx-frontend

# ---- 1. dependencies (no lockfile ships with the template; npm resolves the ranges) ----
FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json ./
RUN npm install --no-audit --no-fund

# ---- 2. build ----
FROM node:22-alpine AS builder
WORKDIR /app
# Build-time values: the image allow-list and the static page list come from WordPress.
ARG NEXWORDX_WP_URL
ARG NEXWORDX_SITE_URL
ARG NEXWORDX_IMAGE_HOSTS=
ARG NEXWORDX_IMAGES_UNOPTIMIZED=
ARG NEXWORDX_REVALIDATE_SECONDS=
ENV NEXWORDX_WP_URL=$NEXWORDX_WP_URL \
    NEXWORDX_SITE_URL=$NEXWORDX_SITE_URL \
    NEXWORDX_IMAGE_HOSTS=$NEXWORDX_IMAGE_HOSTS \
    NEXWORDX_IMAGES_UNOPTIMIZED=$NEXWORDX_IMAGES_UNOPTIMIZED \
    NEXWORDX_REVALIDATE_SECONDS=$NEXWORDX_REVALIDATE_SECONDS \
    NEXT_TELEMETRY_DISABLED=1
COPY --from=deps /app/node_modules ./node_modules
# proxy.ts = Next 16's middleware (the maintenance-mode bypass).
COPY package.json next.config.ts tsconfig.json proxy.ts ./
COPY app ./app
COPY components ./components
COPY lib ./lib
COPY nexwordx-renderer ./nexwordx-renderer
COPY public ./public
RUN npm run build

# ---- 3. runtime (standalone output) ----
FROM node:22-alpine AS runner
WORKDIR /app
ARG NEXWORDX_WP_URL
ARG NEXWORDX_SITE_URL
ARG NEXWORDX_IMAGE_HOSTS=
ARG NEXWORDX_IMAGES_UNOPTIMIZED=
ARG NEXWORDX_REVALIDATE_SECONDS=
# Runtime values: the build-arg defaults can be overridden with `docker run -e …`.
ENV NODE_ENV=production \
    NEXT_TELEMETRY_DISABLED=1 \
    HOSTNAME=0.0.0.0 \
    PORT=3000 \
    NEXWORDX_WP_URL=$NEXWORDX_WP_URL \
    NEXWORDX_SITE_URL=$NEXWORDX_SITE_URL \
    NEXWORDX_IMAGE_HOSTS=$NEXWORDX_IMAGE_HOSTS \
    NEXWORDX_IMAGES_UNOPTIMIZED=$NEXWORDX_IMAGES_UNOPTIMIZED \
    NEXWORDX_REVALIDATE_SECONDS=$NEXWORDX_REVALIDATE_SECONDS \
    NEXWORDX_SECRET=""
# Forms trust the X-Forwarded-For entry of ONE reverse proxy in front (nginx, Caddy, a load
# balancer). Published straight to the internet, visitors can forge it: `-e NEXWORDX_TRUSTED_PROXIES=0`.
ENV NEXWORDX_TRUSTED_PROXIES=1
RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjs
COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
USER nextjs
EXPOSE 3000
CMD ["node", "server.js"]
