FROM pandoc/typst:latest-alpine AS typst

FROM node:22-alpine

# Enable corepack and activate pnpm
RUN corepack enable && corepack prepare pnpm@11.3.0 --activate

# pm2 manages the process; sequelize-cli runs migrations on startup
RUN npm install -g pm2 sequelize-cli

# Typst — compiles certificate.typ into the downloadable PDF certificate.
# Not available as an apk package, so lift the binary out of pandoc/typst.
COPY --from=typst /usr/local/bin/typst /usr/local/bin/typst

WORKDIR /app

# Workspace manifests first (cache-friendly), then a filtered install —
# pnpm needs every workspace package's manifest present to resolve the
# graph even though only apps/api's deps get installed here. pnpm-lock.yaml
# is gitignored (not committed), so this resolves fresh on every build
# rather than installing from a frozen lockfile.
COPY package.json pnpm-workspace.yaml ./
COPY apps/api/package.json ./apps/api/package.json
COPY apps/web/package.json ./apps/web/package.json
RUN pnpm install --filter api...

COPY apps/api ./apps/api

WORKDIR /app/apps/api

RUN chmod +x docker-entrypoint.sh

EXPOSE 3024

ENTRYPOINT ["./docker-entrypoint.sh"]