# Single container: one `deno compile` binary runs API (+ worker role) and serves the prebuilt SPA.
FROM denoland/deno:2.9.7 AS build
WORKDIR /app
COPY . .
RUN deno install --frozen
RUN cd web && deno task build
# --node-modules-dir=none + --exclude-unused-npm: embed only npm packages reachable from the server graph
RUN deno compile --frozen --node-modules-dir=none --exclude-unused-npm \
      --allow-net --allow-env --allow-sys --allow-read=/app \
      --output /out/umt-server apps/server/src/http.ts

FROM debian:trixie-slim
RUN useradd -r -u 1000 umt
WORKDIR /app
COPY --from=build /out/umt-server /app/umt-server
COPY --from=build /app/web/build/client /app/public
ENV WEB_ROOT=/app/public HOST=0.0.0.0 PORT=8080
USER umt
EXPOSE 8080
ENTRYPOINT ["/app/umt-server"]