# OncoDSL Lab — single-image deployment.
# Runs the FastAPI engine, the Next.js front end, and a Caddy reverse proxy
# (with a password gate) behind one HTTPS port. Data is baked into the image.

# ---- Stage 1: build the Next.js front end ----
FROM node:20-slim AS web
WORKDIR /web
COPY web/package*.json ./
RUN npm ci || npm install
COPY web/ ./
RUN mkdir -p public
# The browser calls the engine on the same origin, under /api.
ENV NEXT_PUBLIC_API_URL=/api
RUN npm run build

# ---- Stage 2: runtime (python engine + node + caddy) ----
FROM python:3.11-slim
ENV PYTHONUNBUFFERED=1 NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 \
    HOME=/tmp XDG_DATA_HOME=/tmp/.local/share XDG_CONFIG_HOME=/tmp/.config
WORKDIR /app

# Node (to run `next start`) via NodeSource; Caddy copied from its official image.
RUN apt-get update \
 && apt-get install -y --no-install-recommends curl ca-certificates \
 && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
 && apt-get install -y --no-install-recommends nodejs \
 && rm -rf /var/lib/apt/lists/*
COPY --from=caddy:2 /usr/bin/caddy /usr/bin/caddy

# Python deps
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# App code + baked data (data/processed* is NOT in .dockerignore)
COPY . /app
# Built front end from stage 1
COPY --from=web /web/.next /app/web/.next
COPY --from=web /web/node_modules /app/web/node_modules
COPY --from=web /web/public /app/web/public

COPY deploy/Caddyfile /etc/caddy/Caddyfile
# HF Spaces runs as a non-root user (uid 1000); make the dirs it writes writable.
RUN chmod +x /app/deploy/start.sh \
 && chmod -R a+rwX /app/web/.next \
 && mkdir -p /tmp/.local/share /tmp/.config && chmod -R 777 /tmp/.local /tmp/.config

EXPOSE 7860
CMD ["/app/deploy/start.sh"]