ARG NODE_BUILD_IMAGE=node:24.21.0-bookworm
ARG RUNTIME_IMAGE=debian:bookworm-slim

FROM ${NODE_BUILD_IMAGE} AS build
WORKDIR /src
COPY scripts/check-sqlite-runtime.mjs ./scripts/check-sqlite-runtime.mjs
RUN node scripts/check-sqlite-runtime.mjs
COPY package.json package-lock.json ./
RUN npm ci
COPY index.html vite.config.ts tsconfig*.json ./
COPY src/web ./src/web
COPY src/server ./src/server
COPY src/shared ./src/shared
COPY monitoring/grafana/harbor-gateway.json ./monitoring/grafana/harbor-gateway.json
RUN npm run build:production

FROM ${RUNTIME_IMAGE}
COPY --from=build /usr/local /usr/local
ARG SINGBOX_VERSION=1.14.0-rc.5

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl dumb-init tar \
    && rm -rf /var/lib/apt/lists/*

RUN set -eux; \
    arch="$(dpkg --print-architecture)"; \
    case "$arch" in \
      amd64) sb_arch="amd64" ;; \
      arm64) sb_arch="arm64" ;; \
      *) echo "Unsupported architecture: $arch" >&2; exit 1 ;; \
    esac; \
    curl --retry 5 --retry-all-errors --retry-delay 2 -fsSL "https://github.com/SagerNet/sing-box/releases/download/v${SINGBOX_VERSION}/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}.tar.gz" -o /tmp/sing-box.tgz; \
    tar -xzf /tmp/sing-box.tgz -C /tmp; \
    mv "/tmp/sing-box-${SINGBOX_VERSION}-linux-${sb_arch}/sing-box" /usr/local/bin/sing-box; \
    chmod +x /usr/local/bin/sing-box; \
    rm -rf /tmp/sing-box*

WORKDIR /app
COPY --from=build /src/dist /app/dist
COPY --from=build /src/node_modules/@bufbuild/protobuf /app/node_modules/@bufbuild/protobuf
COPY --from=build /src/node_modules/@connectrpc/connect /app/node_modules/@connectrpc/connect
COPY --from=build /src/node_modules/@connectrpc/connect-node /app/node_modules/@connectrpc/connect-node
COPY --from=build /src/node_modules/tldts /app/node_modules/tldts
COPY --from=build /src/node_modules/tldts-core /app/node_modules/tldts-core
COPY scripts/check-sqlite-runtime.mjs /app/scripts/check-sqlite-runtime.mjs
RUN node /app/scripts/check-sqlite-runtime.mjs
COPY package.json /app/package.json
COPY entrypoint.client.sh /entrypoint.client.sh

RUN chmod +x /entrypoint.client.sh \
    && mkdir -p /etc/sing-box /var/lib/vpn-proxy /var/lib/sing-box

ENV APP_MODE=client \
    PORT=3456 \
    PROXY_PORT=8082 \
    PROXY_BIND_IP=0.0.0.0 \
    DATA_DIR=/var/lib/vpn-proxy \
    SING_BOX_CONFIG=/etc/sing-box/config.json \
    SING_BOX_CACHE=/var/lib/sing-box/cache.db \
    RULE_SET_DOWNLOAD_DETOUR=vpn \
    ROUTING_RU_DIRECT=true \
    SING_BOX_TRAFFIC_SOURCE=native \
    LOG_LEVEL=info

EXPOSE 3456 8082

ENTRYPOINT ["dumb-init", "/entrypoint.client.sh"]