# Deploy artifact (NOT part of the downloadable code tar — the deploy story lives in the post).
# One Ignite app serves BOTH the API (FastAPI) and the built SPA (Vite) on one URL.
# Ignite builds this with Kaniko on `ignite app deploy … --dockerfile-path Dockerfile`.

# ---- stage 1: build the web SPA ----
FROM node:20-slim AS web
WORKDIR /web
COPY web/package.json web/package-lock.json ./
RUN npm ci
COPY web/ ./
# Same-origin API — the SPA is served by the very app it calls. Nothing else to configure:
# end-user login is the Ignite gateway's (attach the pool with `--user-pool <org>/<pool>`), so
# there is no issuer, no audience and no token in the browser build.
ENV VITE_API_BASE=""
RUN npm run build          # -> /web/dist

# ---- stage 2: the python app (serves the API + the SPA static) ----
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt uvicorn
COPY *.py ./
COPY --from=web /web/dist ./web_dist
ENV PORT=8080 \
    WEB_DIST=./web_dist
EXPOSE 8080
# Ignite runs pods with runAsNonRoot: the image MUST declare a NUMERIC uid — the
# kubelet cannot resolve a username against /etc/passwd, so `USER appuser` still
# fails admission with "image will run as root". 8080 is unprivileged, so nothing
# else has to change.
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin app \
 && chown -R 10001:10001 /app
USER 10001
CMD ["sh", "-c", "uvicorn routes:app --host 0.0.0.0 --port ${PORT:-8080}"]
