Dockerfile.dev

# ── Build stage: restic with patched dependencies ─────────
FROM golang:1.26-alpine AS restic-builder

RUN apk add --no-cache git
WORKDIR /build
RUN git clone --branch v0.18.1 --depth 1 https://github.com/restic/restic.git .
RUN go get golang.org/x/crypto@latest \
    && go get golang.org/x/net@latest \
    && go get google.golang.org/grpc@latest \
    && go get google.golang.org/protobuf@latest \
    && go get go.opentelemetry.io/otel/sdk@latest \
    && go get go.opentelemetry.io/otel/sdk/metric@latest \
    && go mod tidy
RUN CGO_ENABLED=0 go build -tags disable_grpc_modules -ldflags "-s -w" -o /restic ./cmd/restic

# ── Development image ─────────────────────────────────────
# Full toolchain + hot reload via NestJS watch mode
FROM node:20-alpine3.22

RUN apk upgrade --no-cache \
    && apk add --no-cache \
    --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main \
    --repository=https://dl-cdn.alpinelinux.org/alpine/v3.22/community \
    postgresql17-client \
    mariadb-client \
    mongodb-tools \
    openssh-client \
    gnupg \
    fuse3 \
    curl

COPY --from=restic-builder /restic /usr/local/bin/restic

# Run as non-root — SSH keys mounted to /home/node/.ssh
RUN mkdir -p /home/node/.ssh /home/node/.gnupg \
    && chmod 700 /home/node/.gnupg \
    && chown -R node:node /home/node/.ssh /home/node/.gnupg

WORKDIR /app

RUN npm install -g npm@latest && npm cache clean --force
COPY package*.json ./
RUN npm ci

COPY tsconfig*.json nest-cli.json ./
RUN chown -R node:node /app

USER node

EXPOSE 3100

CMD ["npm", "run", "start:dev"]