# Stage 1: Frontend bauen
FROM node:20-alpine AS frontend
WORKDIR /build
COPY frontend/package.json frontend/package-lock.json ./
RUN npm install
COPY frontend/ ./
RUN npm run build

# Stage 2: Runtime — bewusst schlanker als beim alten creator:
# kein Playwright/Chromium, kein Tesseract (creator2 braucht beides nicht).
FROM python:3.12-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    ca-certificates \
    poppler-utils \
    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get install -y nodejs \
    && npm install -g @anthropic-ai/claude-code opencode-ai \
    && pip install --no-cache-dir uv \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -m -u 1000 app

COPY backend/requirements.txt /app/backend/requirements.txt
# torch als CPU-Build (~190 MB) — sonst zieht sentence-transformers die
# CUDA-Variante (~2,5 GB).
RUN pip install --no-cache-dir torch --index-url https://download.pytorch.org/whl/cpu \
    && pip install --no-cache-dir -r /app/backend/requirements.txt

COPY --chown=app:app backend/ /app/backend/
# katex + mermaid (+ jsdom fürs headless-DOM, das Mermaid zum Parsen braucht) fürs
# Parse-Gate (backend/{katex,mermaid}_check.mjs prüfen mit dem echten Renderer)
RUN cd /app/backend && npm install --no-audit --no-fund katex mermaid jsdom && chown -R app:app node_modules
COPY --chown=app:app templates/ /app/templates/
COPY --chown=app:app --from=frontend /build/dist /app/frontend/dist
COPY --chown=app:app dev-ops/opencode.json /home/app/.config/opencode/opencode.json

RUN mkdir -p /app/storage /app/topics /home/app/.claude && chown -R app:app /app

USER app
# Embedding-Modell ins Image backen — sonst lädt jeder Container-Neustart
# ~120 MB von Hugging Face (Dedup-Kandidaten, embedding.py)
RUN python3 -c "from sentence_transformers import SentenceTransformer; \
    SentenceTransformer('sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2')"

# Start als root: das Entrypoint nimmt sich die gemounteten Datenverzeichnisse
# (Bind-Mounts tragen Host-Ownership!) und droppt dann auf den App-User.
USER root
COPY dev-ops/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

WORKDIR /app/backend

ENTRYPOINT ["/entrypoint.sh"]
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]