Dockerfile

# ── Stage 1: Build Next.js frontend ───────────────────────────────────────────
FROM node:20-alpine AS web-builder

# Enable pnpm via corepack (bundled with Node 20)
RUN corepack enable && corepack prepare pnpm@latest --activate

WORKDIR /web

# Cache dependency install layer (pnpm uses pnpm-lock.yaml)
COPY web/package.json web/pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

# Copy source and build static export (outputs to /web/out)
COPY web/ ./
ARG NEXT_PUBLIC_API_URL=""
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
RUN pnpm run build

# ── Stage 2: Build Go binary with embedded UI ─────────────────────────────────
FROM golang:1.22-alpine AS builder

# Install git and CA certs (needed for go get over HTTPS)
RUN apk add --no-cache git ca-certificates tzdata

WORKDIR /build

# Cache dependency downloads
COPY go.mod go.sum ./
RUN go mod download

# Copy source
COPY . .

# Bring in the compiled frontend from stage 1
COPY --from=web-builder /web/out ./web/out

ARG VERSION=v1.0.0
ARG BUILD_DATE=unknown

# Build with embed_ui tag so the frontend is baked into the binary
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build \
    -tags embed_ui \
    -ldflags="-X main.Version=${VERSION} -X main.BuildDate=${BUILD_DATE} -s -w" \
    -o vichara \
    ./cmd/vichara

# ── Stage 3: Minimal runtime image ────────────────────────────────────────────
FROM scratch

# Copy TLS certificates and timezone data from builder
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo

# Copy binary (UI is embedded inside it — no extra files needed)
COPY --from=builder /build/vichara /usr/local/bin/vichara

# Copy default config
COPY --from=builder /build/configs/config.yaml /configs/config.yaml

# API + WebSocket + embedded dashboard on :8080
# Prometheus metrics on :9090
EXPOSE 8080 9090

ENTRYPOINT ["/usr/local/bin/vichara"]
CMD ["--mode=all"]