# ─── Stage 1: Build frontend ─────────────────────────────────────────────────
FROM node:20-alpine AS frontend-build

WORKDIR /app/frontend

# Install deps first for better layer caching
COPY frontend/package*.json ./
RUN npm ci --silent

COPY frontend/ ./
RUN npm run build

# ─── Stage 2: Python runtime ─────────────────────────────────────────────────
FROM python:3.11-slim AS runtime

# Install curl (primary healthcheck tool) and keep the image lean
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user early; home directory is created at /home/appuser
RUN useradd --create-home appuser

WORKDIR /app

# Install Python dependencies as root (system-wide, before dropping privileges)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application source
COPY server.py .

# Copy built frontend assets from stage 1
COPY --from=frontend-build /app/frontend/dist ./frontend/dist

# Create a zero-byte placeholder so Docker sees the expected mount path.
# At runtime this file is replaced by the volume-mounted blitzkode.gguf.
RUN touch /app/blitzkode.gguf \
    && chown -R appuser:appuser /app

# ─── Sensible runtime defaults ────────────────────────────────────────────────
# All of these can be overridden at runtime via -e / docker-compose environment.
ENV BLITZKODE_HOST=0.0.0.0 \
    BLITZKODE_PORT=7860 \
    BLITZKODE_MODEL_PATH=/app/blitzkode.gguf \
    BLITZKODE_FRONTEND_PATH=/app/frontend/dist/index.html \
    BLITZKODE_GPU_LAYERS=0 \
    BLITZKODE_THREADS=4 \
    BLITZKODE_PRELOAD_MODEL=true \
    BLITZKODE_N_CTX=2048 \
    BLITZKODE_BATCH=128

EXPOSE 7860

# Healthcheck: prefer curl (installed above); fall back to Python urllib so the
# check still works if this image is rebuilt without the curl layer.
HEALTHCHECK --interval=30s --timeout=10s --start-period=90s --retries=3 \
    CMD curl -sf http://localhost:7860/health \
        || python -c "import urllib.request; urllib.request.urlopen('http://localhost:7860/health')" \
        || exit 1

# Drop to non-root for the actual process
USER appuser

CMD ["python", "server.py"]