# Build context: repository root (docker compose: context ".", dockerfile backend/Dockerfile)

# 1. Web client (Angular) — served by the backend from classpath:/static
FROM node:22-alpine AS web
WORKDIR /web
COPY frontend/package*.json ./
RUN npm install --no-audit --no-fund
COPY frontend/ ./
RUN npx ng build --configuration=production

# 2. Backend
FROM eclipse-temurin:21-jdk-alpine AS build
WORKDIR /app
COPY gradlew settings.gradle ./
COPY gradle gradle
COPY backend/build.gradle backend/
COPY backend/src backend/src
COPY --from=web /web/dist/frontend/browser backend/src/main/resources/static
RUN chmod +x gradlew && ./gradlew :backend:bootJar --no-daemon -x test

# 3. Runtime: not root; data in /app/data (volume)
FROM eclipse-temurin:21-jre-alpine
RUN apk add --no-cache curl && addgroup -S mail && adduser -S -G mail mail \
    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R mail:mail /app/data
WORKDIR /app
COPY --from=build /app/backend/build/libs/*.jar app.jar
USER mail
ENV MAIL_ATTACHMENTS_DIR=/app/data/attachments DKIM_KEYS_DIR=/app/data/dkim-keys
EXPOSE 8080 3025
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
    CMD curl -fsS http://localhost:8080/actuator/health || exit 1
ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75", "-jar", "app.jar"]