# syntax=docker/dockerfile:1
# Caddy (reverse proxy + TLS automatico) con dentro la build statica dell'area riservata (apps/private).
# Contesto di build: radice del monorepo.
#   docker build -f infra/caddy/Dockerfile -t iti-technology/caddy .
# La configurazione dell'area riservata (/config.json) non è nella build: la genera Caddy dalle variabili
# d'ambiente (vedi Caddyfile), quindi la stessa immagine vale per qualunque dominio.

ARG NODE_IMAGE=node:24-bookworm-slim
ARG CADDY_IMAGE=caddy:2-alpine

FROM ${NODE_IMAGE} AS private-deps
WORKDIR /repo
COPY package.json package-lock.json tsconfig.base.json ./
COPY packages/shared/package.json packages/shared/
COPY apps/api/package.json apps/api/
COPY apps/public/package.json apps/public/
COPY apps/private/package.json apps/private/
RUN npm ci --ignore-scripts --no-audit --no-fund -w @iti/private -w @iti/shared --include-workspace-root

FROM private-deps AS private-build
COPY packages/shared packages/shared
COPY packages/styles packages/styles
COPY apps/private apps/private
RUN npm run build -w @iti/shared && npm run build -w @iti/private \
  # in sviluppo config.json non esiste (404 → default); in produzione lo risponde Caddy
  && rm -f apps/private/dist/private/browser/config.json

FROM ${CADDY_IMAGE}
COPY --from=private-build /repo/apps/private/dist/private/browser /srv/area
COPY infra/caddy/Caddyfile /etc/caddy/Caddyfile
COPY infra/caddy/sites /etc/caddy/sites