# Deploy artifact (NOT part of the downloadable code tar — the deploy story lives in the post).
# ONE Ignite app serves the whole CRM suite: seven component routers + the built web UI on one
# FastAPI, one bucket, one URL.
#
# Build context is the code/ directory (the components are siblings):
#     docker build -f crm-suite-app/v1/Dockerfile -t crm-suite .
# Ignite builds it the same way with Kaniko on `ignite app deploy … --dockerfile-path`.

# ---- stage 1: build the web SPA (Vite) ----
FROM node:20-slim AS web
WORKDIR /web
COPY crm-suite-app/v1/web/package.json crm-suite-app/v1/web/package-lock.json ./
RUN npm ci
COPY crm-suite-app/v1/web/ ./
# Same-origin API — the SPA is served by the very app it calls. Nothing else to configure:
# end-user login is the Ignite gateway's (attach the pool with `--user-pool <org>/<pool>`), so
# there is no issuer, no audience and no token in the browser build.
ENV VITE_API_BASE=""
RUN npm run build          # -> /web/dist

# ---- stage 2: the python app (serves the API + the SPA static) ----
FROM python:3.12-slim
WORKDIR /app
COPY crm-suite-app/v1/requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt
# ONE system: the app + the ONE canonical schema + the shared data/auth layer + the UI
# read model + the workflow modules. (The code/crm-*/v1 teaching packages are NOT part of
# the image any more — the suite is self-contained.)
# Every module, not a hand-maintained list. The casting app shipped an explicit
# list, a new module was added without updating it, and the pod crash-looped on
# ModuleNotFoundError *behind a healthy gateway* — the front door still answered
# 401, so it looked deployed. A glob cannot drift from the source tree.
COPY crm-suite-app/v1/*.py ./
COPY crm-suite-app/v1/modules/ ./modules/
# the built SPA — main.py serves / and /assets from here (WEB_DIST); hash routing, so the
# SPA's URLs can never collide with the API paths.
COPY --from=web /web/dist ./web_dist
ENV PORT=8080 \
    WEB_DIST=./web_dist
EXPOSE 8080
# Ignite runs pods with runAsNonRoot: the image MUST declare a NUMERIC uid — the kubelet
# cannot resolve a username against /etc/passwd, so `USER appuser` fails admission with
# "image will run as root". 8080 is unprivileged, so nothing else has to change.
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin app \
 && chown -R 10001:10001 /app
USER 10001
CMD ["sh", "-c", "uvicorn main:app --host 0.0.0.0 --port ${PORT:-8080}"]
