# syntax=docker/dockerfile:1
# Chainguard/Wolfi MeshChatX image (hardened tags).
# Glibc LXST wheels as published. Musl filterlib bake is skipped.
# Runtime uses opus (not Alpine opusfile). Voicemail without espeak-ng is optional.

ARG NODE_IMAGE=cgr.dev/chainguard/node:latest-dev
ARG PYTHON_BUILD_IMAGE=cgr.dev/chainguard/python:latest-dev
ARG PYTHON_RUNTIME_IMAGE=cgr.dev/chainguard/python:latest-dev

FROM --platform=linux/amd64 ${NODE_IMAGE} AS build-frontend
USER root
WORKDIR /src
RUN apk add --no-cache git python3 go
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml vite.config.js ./
COPY patches ./patches
COPY scripts/fetch-micron-wasm.mjs scripts/fetch-micron-wasm.mjs
COPY scripts/micron-wasm-resolve-bundled.mjs scripts/micron-wasm-resolve-bundled.mjs
COPY scripts/micron-parser-go-version.mjs scripts/micron-parser-go-version.mjs
COPY scripts/vite-dx.mjs scripts/vite-dx.mjs
COPY scripts/build-visualiser-wasm.mjs scripts/build-visualiser-wasm.mjs
COPY scripts/sync-meshchatx-docs.js scripts/sync-meshchatx-docs.js
COPY scripts/pip_rns_remotes.py scripts/pip_rns_remotes.py
COPY scripts/build/fetch_reticulum_manual.py scripts/build/fetch_reticulum_manual.py
COPY scripts/build/generate_service_worker.mjs scripts/build/generate_service_worker.mjs
COPY scripts/docker/build-frontend.sh scripts/docker/build-frontend.sh
COPY docs ./docs
COPY visualiser-wasm ./visualiser-wasm
COPY meshchatx/src/frontend ./meshchatx/src/frontend
ENV GOCACHE=/tmp/go-cache
ENV GOTMPDIR=/tmp/go-tmp
RUN sh scripts/docker/build-frontend.sh

FROM ${PYTHON_BUILD_IMAGE} AS builder
USER root
WORKDIR /build
COPY scripts/docker/builder-apk-chainguard.sh scripts/docker/builder-apk-chainguard.sh
RUN sh scripts/docker/builder-apk-chainguard.sh
RUN pip install --no-cache-dir --upgrade "pip>=26.0" uv setuptools wheel "jaraco.context>=6.1.0"
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
ENV UV_PROJECT_ENVIRONMENT=/opt/venv
RUN pip install --no-cache-dir --upgrade "pip>=26.0" "setuptools" "jaraco.context>=6.1.0"
COPY pyproject.toml uv.lock README.md CHANGELOG.md ./
COPY logo ./logo
COPY vendor ./vendor
COPY scripts/patch_lxst_pyogg_ogg_ctypes.py ./scripts/patch_lxst_pyogg_ogg_ctypes.py
COPY scripts/patch_lxst_codec2_optional.py ./scripts/patch_lxst_codec2_optional.py
COPY meshchatx/src/backend/lxst_pyogg_ctypes_compat.py ./meshchatx/src/backend/lxst_pyogg_ctypes_compat.py
COPY scripts/docker/prepare-venv.sh scripts/docker/prepare-venv.sh
COPY scripts/docker/build-app-overlay.sh scripts/docker/build-app-overlay.sh
ENV MESHCHATX_DOCKER_SKIP_MUSL_FILTERLIB=1
RUN sh scripts/docker/prepare-venv.sh
COPY meshchatx ./meshchatx
COPY --from=build-frontend /src/meshchatx/public ./meshchatx/public
RUN sh scripts/docker/build-app-overlay.sh

FROM ${PYTHON_RUNTIME_IMAGE}
USER root
COPY scripts/docker/runtime-setup-chainguard.sh /tmp/runtime-setup-chainguard.sh
RUN sh /tmp/runtime-setup-chainguard.sh && rm /tmp/runtime-setup-chainguard.sh
COPY --from=builder --chown=meshchat:meshchat /opt/venv-deps /opt/venv
COPY --from=builder --chown=meshchat:meshchat /opt/app-overlay/ /opt/venv/
COPY scripts/docker_entrypoint_chainguard.py /docker-entrypoint.py

ARG OCI_REVISION=""
ARG OCI_VERSION=""
ARG OCI_CREATED=""

LABEL org.opencontainers.image.source="https://github.com/Quad4-Software/MeshChatX"
LABEL org.opencontainers.image.description="MeshChatX is an all-in-one Reticulum client."
LABEL org.opencontainers.image.licenses="MIT AND 0BSD"
LABEL org.opencontainers.image.authors="Quad4"
LABEL org.opencontainers.image.revision="${OCI_REVISION}"
LABEL org.opencontainers.image.version="${OCI_VERSION}"
LABEL org.opencontainers.image.created="${OCI_CREATED}"

ENV PATH="/opt/venv/bin:$PATH"
ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1
ENV MESHCHAT_FORCE_WEB_AUDIO=1

USER meshchat

HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
    CMD ["python", "-c", "import ssl, urllib.request; urllib.request.urlopen('https://127.0.0.1:8000/api/v1/status', context=ssl._create_unverified_context())"]

ENTRYPOINT ["/usr/bin/python", "/docker-entrypoint.py"]
CMD ["/opt/venv/bin/meshchatx", "--host=0.0.0.0", "--reticulum-config-dir=/config/.reticulum", "--storage-dir=/config/.reticulum-meshchatx", "--headless"]