# Build the web UI first; vite writes straight into the Go package that
# embeds it, so the Go stage picks it up without extra wiring.
FROM node:22-alpine AS ui
WORKDIR /src/web
COPY web/package.json web/package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY web/ ./
RUN npm run build

FROM golang:1.26-alpine AS build
ARG VERSION=dev
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=ui /src/internal/webui/dist ./internal/webui/dist
# A static binary keeps the runtime image free of a libc and lets the same
# artifact be copied onto a bare-metal host.
RUN CGO_ENABLED=0 go build -trimpath \
      -ldflags "-s -w -X main.version=${VERSION}" \
      -o /out/docker-migrate .

FROM alpine:3.22
RUN apk add --no-cache ca-certificates tzdata && \
    adduser -D -u 10001 migrate
COPY --from=build /out/docker-migrate /usr/local/bin/docker-migrate

# The container talks to the Docker socket mounted from the host, which is
# owned by root:docker. It therefore runs as root by default; set --user to
# override when the socket permissions on your host allow it.
ENV DOCKER_MIGRATE_DATA=/data
VOLUME ["/data"]
EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=5s \
  CMD wget -qO- http://127.0.0.1:8080/api/health >/dev/null || exit 1

ENTRYPOINT ["docker-migrate"]
CMD ["serve", "--addr", "0.0.0.0:8080"]