# InternetPressure.io — web (Next 16 standalone). Build from the REPOSITORY ROOT:
#   docker build -f apps/web/Dockerfile -t internetpressure-web .
# The dev mock (apps/web/mock) is excluded via apps/web/Dockerfile.dockerignore and is never part of the image.

FROM node:22-alpine AS deps
RUN corepack enable && corepack prepare pnpm@11 --activate
WORKDIR /repo
COPY apps/web/package.json apps/web/pnpm-lock.yaml apps/web/pnpm-workspace.yaml apps/web/
# pnpm rejects very recent releases by default (minimumReleaseAge, see pnpm-workspace.yaml): the lockfile is what we tested.
RUN cd apps/web && pnpm install --frozen-lockfile --ignore-scripts

FROM node:22-alpine AS build
RUN corepack enable && corepack prepare pnpm@11 --activate
WORKDIR /repo
COPY --from=deps /repo/apps/web/node_modules apps/web/node_modules
COPY apps/web apps/web
# Static pages (/methodology, /api) tolerate an unreachable API at build time (they fall back to documented defaults).
ENV NEXT_TELEMETRY_DISABLED=1
RUN cd apps/web && pnpm build

FROM node:22-alpine AS runtime
ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=8351 HOSTNAME=0.0.0.0
WORKDIR /app
RUN addgroup -S web && adduser -S web -G web
# outputFileTracingRoot = repo root → the standalone server lives at apps/web/server.js
COPY --from=build --chown=web:web /repo/apps/web/.next/standalone ./
COPY --from=build --chown=web:web /repo/apps/web/.next/static ./apps/web/.next/static
COPY --from=build --chown=web:web /repo/apps/web/public ./apps/web/public
USER web
EXPOSE 8351
CMD ["node", "apps/web/server.js"]