# Todo's server image (ADR 0033, step 5). Built from the repository root (the build
# context), because the workspace's root pubspec and lockfile live there:
#
#   docker build -f apps/todo/halkyon_todo_server/Dockerfile .
#
# Train's server image (apps/train/halkyon_train_server/Dockerfile) for Todo, as
# Learn's: the same Dart, the same Ubuntu runtime and start command; no git, no
# repositories folder, no data of its own.

# ── Build stage: compile the server to a native executable ────────────────────────
FROM dart:3.13.4 AS build
WORKDIR /app
COPY pubspec.yaml pubspec.lock ./
COPY tool/workspace_only.sh tool/
# The root's dependency_overrides name these by path; pub refuses a path
# that isn't there, though no server uses them.
COPY third_party third_party
COPY apps/todo/halkyon_todo_server apps/todo/halkyon_todo_server
COPY packages/halkyon_base_server packages/halkyon_base_server
COPY packages/halkyon_base_client packages/halkyon_base_client
COPY packages/halkyon_core packages/halkyon_core
COPY packages/halkyon_llm packages/halkyon_llm
COPY packages/halkyon_oidc_server packages/halkyon_oidc_server
COPY packages/halkyon_oidc_client packages/halkyon_oidc_client

# The workspace root with only the server and the modules it builds on, as Learn's
# image has it (the reasons there).
RUN sh tool/workspace_only.sh apps/todo/halkyon_todo_server packages/halkyon_base_server packages/halkyon_base_client packages/halkyon_core packages/halkyon_llm packages/halkyon_oidc_server packages/halkyon_oidc_client
RUN dart pub get
WORKDIR /app/apps/todo/halkyon_todo_server
RUN dart build cli --target bin/main.dart --output build
RUN mv build/bundle/bin/main build/bundle/bin/server
RUN mkdir -p config migrations

# ── Runtime stage ─────────────────────────────────────────────────────────────────
# Ubuntu 24.04 as Learn's; CA certificates for outgoing TLS (the operator's
# assistants, which the module forwards, ADR 0021).
FROM ubuntu:24.04
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/*
WORKDIR /app

ENV runmode=production
ENV serverid=default
ENV logging=normal
ENV role=monolith

COPY --from=build /app/apps/todo/halkyon_todo_server/build/bundle/ ./
COPY --from=build /app/apps/todo/halkyon_todo_server/config/ config/
COPY --from=build /app/apps/todo/halkyon_todo_server/migrations/ migrations/
COPY --from=build /app/apps/todo/halkyon_todo_server/lib/src/generated/protocol.yaml lib/src/generated/protocol.yaml

# No root rights needed: it listens on 8080 and 8082 and writes nothing.
RUN useradd --system --no-create-home --shell /usr/sbin/nologin app
USER app

# The API server, and the web server the register tells of accounts gone (ADR
# 0016), reached on the instance's own network alone.
EXPOSE 8080 8082

ENTRYPOINT ["/bin/sh", "-c", "exec ./bin/server --mode=$runmode --server-id=$serverid --logging=$logging --role=$role \"$@\"", "--"]
CMD []