# Multi-stage build for VAPORA Backend
# Build stage
FROM rust:1.75-alpine AS builder

WORKDIR /usr/src/app

# Install build dependencies
RUN apk add --no-cache \
    musl-dev \
    pkgconfig \
    openssl-dev \
    openssl-libs-static

# Copy workspace files
COPY Cargo.toml Cargo.lock ./
COPY crates ./crates

# Build backend (release mode with optimizations)
RUN cargo build --release -p vapora-backend

# Runtime stage
FROM alpine:latest

RUN apk add --no-cache \
    ca-certificates \
    openssl \
    curl

WORKDIR /app

# Copy binary from builder
COPY --from=builder /usr/src/app/target/release/vapora-backend /app/vapora-backend

# Create non-root user
RUN addgroup -g 1000 vapora && \
    adduser -D -u 1000 -G vapora vapora && \
    chown -R vapora:vapora /app

USER vapora

# Expose port
EXPOSE 8080

# Health check
HEALTHCHECK --interval=10s --timeout=5s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1

# Run
ENTRYPOINT ["/app/vapora-backend"]