StaticBuild

# syntax=docker/dockerfile:1

############################################
# Builder: install deps and build frontend #
############################################
FROM node:24-alpine AS buildnode

WORKDIR /app/
COPY ./src/frontend/package.json ./src/frontend/package-lock.json ./src/frontend/.npmrc ./

RUN --mount=type=secret,id=FONTAWESOME_PACKAGE_TOKEN \
    test -s /run/secrets/FONTAWESOME_PACKAGE_TOKEN || { echo "FONTAWESOME_PACKAGE_TOKEN secret missing"; exit 1; }; \
    export FONTAWESOME_PACKAGE_TOKEN="$(cat /run/secrets/FONTAWESOME_PACKAGE_TOKEN)" && \
    npm ci

COPY ./src/frontend/ /app/

RUN npm run openshift_build

############################################
# Builder: compile brotli modules from     #
# source against the exact nginx version   #
############################################
FROM nginx:stable-alpine3.23 AS brotli-builder

RUN apk add --no-cache \
    git cmake gcc g++ make \
    pcre2-dev zlib-dev openssl-dev \
    linux-headers brotli-dev

RUN git clone --recurse-submodules https://github.com/google/ngx_brotli /ngx_brotli

RUN set -eux; \
    NGINX_VERSION=$(nginx -v 2>&1 | sed 's|.*nginx/||'); \
    wget -q "https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz"; \
    tar -xzf "nginx-${NGINX_VERSION}.tar.gz"; \
    NGINX_CONFIGURE_ARGS=$(nginx -V 2>&1 | grep 'configure arguments:' | sed 's/configure arguments: //'); \
    cd "nginx-${NGINX_VERSION}"; \
    eval "./configure ${NGINX_CONFIGURE_ARGS} --add-dynamic-module=/ngx_brotli"; \
    make modules

RUN mkdir /brotli-modules && \
    find /nginx-*/objs -name 'ngx_http_brotli_*.so' -exec cp {} /brotli-modules/ \;

############################################
# Runtime: nginx serving built assets      #
############################################
FROM nginx:stable-alpine3.23

EXPOSE 3000

# Install Brotli CLI tool for compressing static assets at build-time.
RUN apk add --no-cache brotli

# Copy pre-compiled brotli modules — no apk install needed, no version mismatches
COPY --from=brotli-builder /brotli-modules/ /etc/nginx/modules/

# Load modules and harden nginx.conf for OpenShift (non-root, no pid in /var/run)
RUN sed -i '1i load_module modules/ngx_http_brotli_filter_module.so;\nload_module modules/ngx_http_brotli_static_module.so;' /etc/nginx/nginx.conf && \
    sed -i '/^user/d' /etc/nginx/nginx.conf && \
    sed -i 's|^pid .*|pid /tmp/nginx.pid;|' /etc/nginx/nginx.conf

# Create all necessary temp and cache directories
RUN mkdir -p /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp /tmp/cache/nginx \
    && chmod -R 777 /tmp/client_temp /tmp/proxy_temp /tmp/fastcgi_temp /tmp/uwsgi_temp /tmp/scgi_temp /tmp/cache/nginx

# Copy built assets
RUN mkdir -p /usr/share/nginx/html
COPY --from=buildnode /app/build /usr/share/nginx/html

# --- Pre-compress Static Assets (JS, CSS, SVG) ---
RUN echo "Pre-compressing static assets with Gzip and Brotli..." && \
    find /usr/share/nginx/html/static/js -name "*.js" -exec gzip -k -9 {} + && \
    find /usr/share/nginx/html/static/css -name "*.css" -exec gzip -k -9 {} + && \
    find /usr/share/nginx/html/static/media -name "*.svg" -exec gzip -k -9 {} + && \
    find /usr/share/nginx/html/static/js -name "*.js" -exec brotli -f -k -q 11 {} + && \
    find /usr/share/nginx/html/static/css -name "*.css" -exec brotli -f -k -q 11 {} + && \
    find /usr/share/nginx/html/static/media -name "*.svg" -exec brotli -f -k -q 11 {} +

# Copy NGINX configuration files
COPY ./compose/frontend/default.conf /etc/nginx/conf.d/default.conf
COPY ./compose/frontend/security_headers.conf /etc/nginx/conf.d/security_headers.conf
COPY ./compose/frontend/security_headers_admin.conf /etc/nginx/conf.d/security_headers_admin.conf
COPY ./compose/frontend/blocked_ips.conf /etc/nginx/conf.d/blocked_ips.conf
COPY ./compose/frontend/legacy_redirects.conf /etc/nginx/legacy_redirects.conf

# Runtime env injection hook (run by an initContainer in OpenShift)
COPY --chmod=755 ./compose/frontend/generate-config.sh /tmp/generate-config.sh