# syntax=docker/dockerfile:1
#
# Single multi-stage Dockerfile for ECHODO. Build via Docker Compose with
# `target:` to select web | collab | mcp | orchestrator | worker.
#
# Why one file instead of three?
#   - The `deps` stage runs `pnpm install` ONCE for all 723 workspace packages.
#     BuildKit shares it across every downstream target by content hash, so
#     web + collab + mcp build in parallel without three concurrent installs
#     blowing through the build host's RAM.
#   - Per-app build stages (`web-build`, `collab-build`, `mcp-build`) only
#     copy the source they actually need.
#   - Final runtime stages (`web`, `collab`, `mcp`) pull just the built
#     artifacts and the per-app node_modules they need at runtime.

ARG NODE_VERSION=20.18.1


# ============================================================================
# base — shared toolchain
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS base
RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
WORKDIR /app


# ============================================================================
# deps — shared pnpm install for the entire workspace
# Cached aggressively: invalidates only when package.json or lockfile changes.
# ============================================================================
FROM base AS deps
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json tsconfig.json ./
COPY apps/web/package.json ./apps/web/
COPY apps/collab-server/package.json ./apps/collab-server/
COPY apps/mcp-server/package.json ./apps/mcp-server/
COPY apps/orchestrator/package.json ./apps/orchestrator/
COPY apps/worker/package.json ./apps/worker/
COPY packages/database/package.json ./packages/database/
COPY packages/shared/package.json ./packages/shared/
COPY packages/ai/package.json ./packages/ai/
RUN pnpm install --frozen-lockfile


# NOTE: Stage order matters. `web-build` must be defined AFTER `collab-build`
# and `mcp-build` because it `COPY --from=`s them to force BuildKit to
# finish the light tsup builds before starting the heavy Next.js compile.
# Coolify's builder requires stages referenced via `--from=` to be defined
# above the referencing stage; forward references fail with "cannot copy
# from stage X, it needs to be defined before current stage Y".


# ============================================================================
# collab-build — tsup build for Hocuspocus server
# ============================================================================
FROM deps AS collab-build
COPY apps/collab-server ./apps/collab-server
COPY packages/database ./packages/database

ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/collab-server


# ============================================================================
# mcp-build — tsup build for MCP server
# ============================================================================
FROM deps AS mcp-build
COPY apps/mcp-server ./apps/mcp-server
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared

ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/mcp-server


# ============================================================================
# orchestrator-build — tsup build for convoy driver
# ============================================================================
FROM deps AS orchestrator-build
COPY apps/orchestrator ./apps/orchestrator
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared

ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/orchestrator


# ============================================================================
# worker-build — tsup build for agent runtime
# ============================================================================
FROM deps AS worker-build
COPY apps/worker ./apps/worker
COPY packages/ai ./packages/ai
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared

ENV NODE_ENV=production
RUN pnpm exec turbo build --filter=@tasks/worker


# ============================================================================
# web-build — Next.js production build → standalone output
# ============================================================================
FROM deps AS web-build
COPY apps/web ./apps/web
COPY packages/ai ./packages/ai
COPY packages/database ./packages/database
COPY packages/shared ./packages/shared
COPY docker/next.config.docker.ts ./apps/web/next.config.ts

# Force BuildKit to finish the two tsup builds before starting the heavy
# Next.js compile. docker-compose's `depends_on` only orders runtime startup,
# not `docker compose build` — without these COPYs, BuildKit runs all three
# build stages in parallel and the host OOMs around the 73s mark of the web
# build (kernel reaps with exit 255 and no Docker error, matching the warning
# below about heap sizing). The copied files are throwaway markers; the
# runtime web image never reads /tmp.
COPY --from=collab-build /app/apps/collab-server/dist/index.mjs /tmp/.collab-built
COPY --from=mcp-build /app/apps/mcp-server/dist/index.js /tmp/.mcp-built
COPY --from=orchestrator-build /app/apps/orchestrator/dist/index.js /tmp/.orchestrator-built
COPY --from=worker-build /app/apps/worker/dist/index.js /tmp/.worker-built

ENV NEXT_TELEMETRY_DISABLED=1
ENV NODE_ENV=production
# Give the Next.js webpack compile enough V8 heap headroom on the Coolify host.
# Sized to ~60% of an 8 GB host so kernel + dockerd + buildkit + concurrent
# tsup workers still have breathing room. Below ~3 GB the compile spirals
# into GC churn and gets oom-killed (exit 255 with no Docker error).
ENV NODE_OPTIONS=--max-old-space-size=5120
# Local dev uses a gitignored apps/web/.env symlink; drop it so Next.js does not
# follow a broken link inside the container.
RUN rm -f apps/web/.env apps/web/.env.local apps/web/.env.production apps/web/.env.development

# NEXT_PUBLIC_* must be present at build time — Next.js inlines them into the client bundle.
ARG NEXT_PUBLIC_COLLAB_SERVER_URL=ws://localhost:1234
ARG NEXT_PUBLIC_UMAMI_SCRIPT=
ARG NEXT_PUBLIC_UMAMI_WEBSITE_ID=
ARG NEXT_PUBLIC_LIBREDESK_URL=
ARG NEXT_PUBLIC_LIBREDESK_WIDGET_ID=
ARG NEXT_PUBLIC_DIRECTUS_URL=
ENV NEXT_PUBLIC_COLLAB_SERVER_URL=${NEXT_PUBLIC_COLLAB_SERVER_URL}
ENV NEXT_PUBLIC_UMAMI_SCRIPT=${NEXT_PUBLIC_UMAMI_SCRIPT}
ENV NEXT_PUBLIC_UMAMI_WEBSITE_ID=${NEXT_PUBLIC_UMAMI_WEBSITE_ID}
ENV NEXT_PUBLIC_LIBREDESK_URL=${NEXT_PUBLIC_LIBREDESK_URL}
ENV NEXT_PUBLIC_LIBREDESK_WIDGET_ID=${NEXT_PUBLIC_LIBREDESK_WIDGET_ID}
ENV NEXT_PUBLIC_DIRECTUS_URL=${NEXT_PUBLIC_DIRECTUS_URL}

RUN pnpm exec turbo build --filter=@tasks/web


# ============================================================================
# web — runtime image (Next.js standalone)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS web
RUN apk add --no-cache wget \
  && addgroup --system --gid 1001 nodejs \
  && adduser --system --uid 1001 nextjs

WORKDIR /app

ENV NODE_ENV=production
ENV PORT=3000
ENV HOSTNAME=0.0.0.0

COPY --from=web-build --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
COPY --from=web-build --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
COPY --from=web-build --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public

USER nextjs

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD wget -qO- --timeout=3 http://127.0.0.1:3000/ >/dev/null || exit 1

CMD ["node", "apps/web/server.js"]


# ============================================================================
# collab — runtime image (Hocuspocus / Yjs websocket)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS collab
RUN addgroup --system --gid 1001 nodejs \
  && adduser --system --uid 1001 collab --ingroup nodejs

WORKDIR /app

ENV NODE_ENV=production
ENV PORT=1234

COPY --from=collab-build --chown=collab:nodejs /app/node_modules ./node_modules
COPY --from=collab-build --chown=collab:nodejs /app/packages/database ./packages/database
COPY --from=collab-build --chown=collab:nodejs /app/apps/collab-server/dist ./apps/collab-server/dist
COPY --from=collab-build --chown=collab:nodejs /app/apps/collab-server/package.json ./apps/collab-server/package.json
COPY --from=collab-build --chown=collab:nodejs /app/apps/collab-server/node_modules ./apps/collab-server/node_modules

USER collab

EXPOSE 1234

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD node -e "const p=+(process.env.PORT||1234);require('net').createConnection(p,'127.0.0.1').on('connect',()=>process.exit(0)).on('error',()=>process.exit(1))"

WORKDIR /app/apps/collab-server
CMD ["node", "dist/index.mjs"]


# ============================================================================
# mcp — runtime image (Model Context Protocol server)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS mcp
ARG MCP_SERVER_PORT=3001
ENV MCP_SERVER_PORT=${MCP_SERVER_PORT}

RUN apk add --no-cache procps \
  && addgroup --system --gid 1001 nodejs \
  && adduser --system --uid 1001 mcp --ingroup nodejs

WORKDIR /app

ENV NODE_ENV=production

COPY --from=mcp-build --chown=mcp:nodejs /app/node_modules ./node_modules
COPY --from=mcp-build --chown=mcp:nodejs /app/packages/database ./packages/database
COPY --from=mcp-build --chown=mcp:nodejs /app/packages/shared ./packages/shared
COPY --from=mcp-build --chown=mcp:nodejs /app/apps/mcp-server/dist ./apps/mcp-server/dist
COPY --from=mcp-build --chown=mcp:nodejs /app/apps/mcp-server/package.json ./apps/mcp-server/package.json
COPY --from=mcp-build --chown=mcp:nodejs /app/apps/mcp-server/node_modules ./apps/mcp-server/node_modules

USER mcp

WORKDIR /app/apps/mcp-server

EXPOSE 3001

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD pgrep -f "node.*dist/index\\.js" > /dev/null || exit 1

CMD ["node", "dist/index.js"]


# ============================================================================
# orchestrator — runtime image (convoy driver + Redis enqueue)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS orchestrator
RUN addgroup --system --gid 1001 nodejs \
  && adduser --system --uid 1001 orchestrator --ingroup nodejs

WORKDIR /app

ENV NODE_ENV=production

COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/node_modules ./node_modules
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/packages/database ./packages/database
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/packages/shared ./packages/shared
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/apps/orchestrator/dist ./apps/orchestrator/dist
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/apps/orchestrator/package.json ./apps/orchestrator/package.json
COPY --from=orchestrator-build --chown=orchestrator:nodejs /app/apps/orchestrator/node_modules ./apps/orchestrator/node_modules

USER orchestrator

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD pgrep -f "node.*dist/index\\.js" > /dev/null || exit 1

WORKDIR /app/apps/orchestrator
CMD ["node", "dist/index.js"]


# ============================================================================
# worker — runtime image (orchestrator job consumer + tool loop)
# ============================================================================
FROM node:${NODE_VERSION}-alpine AS worker
RUN apk add --no-cache git ripgrep procps \
  && addgroup --system --gid 1001 nodejs \
  && adduser --system --uid 1001 worker --ingroup nodejs

WORKDIR /app

ENV NODE_ENV=production
ENV WORKER_REPO_ROOT=/app/repo

COPY --from=worker-build --chown=worker:nodejs /app/node_modules ./node_modules
COPY --from=worker-build --chown=worker:nodejs /app/packages/ai ./packages/ai
COPY --from=worker-build --chown=worker:nodejs /app/packages/database ./packages/database
COPY --from=worker-build --chown=worker:nodejs /app/packages/shared ./packages/shared
COPY --from=worker-build --chown=worker:nodejs /app/apps/worker/dist ./apps/worker/dist
COPY --from=worker-build --chown=worker:nodejs /app/apps/worker/package.json ./apps/worker/package.json
COPY --from=worker-build --chown=worker:nodejs /app/apps/worker/node_modules ./apps/worker/node_modules

# Repo snapshot for tool loop + git worktrees (dogfood / connected-repo jobs).
COPY --chown=worker:nodejs apps ./repo/apps
COPY --chown=worker:nodejs packages ./repo/packages
COPY --chown=worker:nodejs plans ./repo/plans
COPY --chown=worker:nodejs .cursor/mcp.json ./repo/.cursor/mcp.json
COPY --chown=worker:nodejs .cursor/rules ./repo/.cursor/rules
COPY --chown=worker:nodejs .agents/skills ./repo/.agents/skills
RUN mkdir -p /app/repo/.cursor/agents
COPY --chown=worker:nodejs pnpm-workspace.yaml package.json turbo.json tsconfig.json ./repo/
COPY --chown=worker:nodejs docker/worker-entrypoint.sh /app/worker-entrypoint.sh
RUN chmod +x /app/worker-entrypoint.sh

# Minimal git repo so worktrees + allowlisted git commands work on the deploy snapshot.
USER root
RUN cd /app/repo \
  && git init -q \
  && git config user.email "worker@echodo" \
  && git config user.name "echodo-worker" \
  && git add -A \
  && git -c commit.gpgsign=false commit -q -m "deploy snapshot" \
  || true
USER worker

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD pgrep -f "node.*dist/index\\.js" > /dev/null || exit 1

WORKDIR /app/apps/worker
ENTRYPOINT ["/app/worker-entrypoint.sh"]