FROM oven/bun:1.4.4 AS frontend
WORKDIR /app
COPY package.json bun.lock ./
RUN bun install --frozen-lockfile
COPY . .
RUN bun run build

FROM rust:1-bookworm AS builder
WORKDIR /app
RUN apt-get update && apt-get install -y --no-install-recommends \
    pkg-config \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*
COPY jean-core ./jean-core
COPY src-server ./src-server
COPY --from=frontend /app/dist ./dist
RUN cd src-server && RUSTC_WRAPPER= cargo build --release --locked

FROM debian:bookworm-slim AS runtime
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    git \
    openssh-client \
    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
        -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
        > /etc/apt/sources.list.d/github-cli.list \
    && apt-get update && apt-get install -y --no-install-recommends gh \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --create-home --shell /bin/bash jean \
    && mkdir -p /home/jean/.cache /home/jean/.config /home/jean/.local/share/com.jean.desktop \
    && chown -R jean:jean /home/jean
COPY --from=builder /app/src-server/target/release/jean-server /usr/local/bin/jean-server
COPY scripts/docker-entrypoint.sh /usr/local/bin/jean-server-entrypoint
RUN chmod +x /usr/local/bin/jean-server-entrypoint
USER jean
ENV PATH="/home/jean/.local/bin:${PATH}" \
    JEAN_HOST=0.0.0.0 \
    JEAN_PORT=3456
EXPOSE 3456
VOLUME ["/home/jean"]
ENTRYPOINT ["/usr/local/bin/jean-server-entrypoint"]