# syntax=docker/dockerfile:1.6
# Find eligible builder and runner images on Docker Hub. We use Ubuntu/Debian
# instead of Alpine to avoid DNS resolution issues in production.
#
# https://hub.docker.com/r/hexpm/elixir/tags?name=ubuntu
# https://hub.docker.com/_/ubuntu/tags
#
# This file is based on these images:
#
#   - https://hub.docker.com/r/hexpm/elixir/tags - for the build image
#   - codeberg.org/gmcintire/prop-base - prebuilt runtime base (see Dockerfile.base)
#   - Ex: docker.io/hexpm/elixir:1.19.5-erlang-28.4.1-debian-trixie-20260316-slim
#
ARG ELIXIR_VERSION=1.20.1
ARG OTP_VERSION=29.0.2
ARG DEBIAN_VERSION=trixie-20260518-slim

ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}"
# Prebuilt runtime base contains wgrib2 + cdo + gdal-bin + locale + the
# BEAM runtime apt deps. Built by .forgejo/workflows/build-base.yaml
# only when Dockerfile.base changes, so this Dockerfile pulls a
# ready-made layer instead of recompiling wgrib2 + reinstalling cdo
# (~10 min) on every push.
ARG BASE_IMAGE="codeberg.org/gmcintire/prop-base:latest"

# ---- Elixir build stage ----
FROM ${BUILDER_IMAGE} AS builder

# install build dependencies
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    rm -f /etc/apt/apt.conf.d/docker-clean \
    && apt-get update \
    && apt-get install -y --no-install-recommends build-essential git

# prepare build dir
WORKDIR /app

# install hex + rebar
RUN mix local.hex --force \
  && mix local.rebar --force

# set build ENV
ENV MIX_ENV="prod"

# install mix dependencies (changes only when mix.exs/mix.lock change)
COPY mix.exs mix.lock ./
COPY vendor vendor
RUN mix deps.get --only $MIX_ENV

# copy compile-time config before compiling deps
RUN mkdir config
COPY config/config.exs config/${MIX_ENV}.exs config/
RUN mix deps.compile

# install esbuild + tailwind binaries (cached until mix.exs changes)
RUN mix assets.setup

# create priv dir so :code.priv_dir works at compile time
# (actual contents copied after compile to avoid cache busting)
RUN mkdir -p priv/models priv/static

# copy application code and compile
COPY lib lib
COPY algo.md algo.md
# agent-skills markdown is read at compile time by AgentSkillsController
# (sha256 digests are baked into the module attribute)
COPY priv/agent-skills priv/agent-skills
# /docs/api artifacts are read at compile time by ApiDocsController
# and ApiDocsLive (baked into module attributes).
COPY docs/api docs/api
RUN mix compile

# copy assets and build (JS/CSS changes don't require recompilation)
COPY assets assets
RUN mix assets.deploy

# copy priv contents (migrations, ML model, static files)
# after compile so model retraining doesn't bust the compile cache
COPY priv priv

# runtime config doesn't require recompilation
COPY config/runtime.exs config/

COPY rel rel
RUN mix release

# ---- Final runtime stage ----
# Pulls the prebuilt prop-base image (Dockerfile.base) which already
# carries wgrib2 + g2c libs + cdo + gdal-bin + locale + BEAM runtime
# apt deps. We just COPY the Elixir release on top.
FROM ${BASE_IMAGE} AS final

# Build timestamp baked in by CI (--build-arg BUILD_TIMESTAMP=...).
# Only consumed in this final stage, so it never busts the earlier
# compile cache. Read at runtime by Microwaveprop.Application.build_timestamp/0.
ARG BUILD_TIMESTAMP=unknown

ENV MIX_ENV="prod"

WORKDIR "/app"
RUN chown nobody /app

COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/microwaveprop ./

RUN echo "${BUILD_TIMESTAMP}" > /app/BUILD_TIMESTAMP \
  && chown nobody /app/BUILD_TIMESTAMP

USER nobody

CMD ["/app/bin/server"]