# Use the full Node image so workerd has a working CA trust store for outbound HTTPS.
FROM node:22

ENV PNPM_HOME=/pnpm
ENV PATH=$PNPM_HOME:$PATH

WORKDIR /app

RUN corepack enable && corepack prepare pnpm@10.30.1 --activate

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
RUN pnpm install --frozen-lockfile

COPY . .

EXPOSE 3001

# The build MUST run at container start, not image-build time: AUTH_MODE (and the
# other client envs) are inlined into the client bundle by `vite build`, and the
# self-hoster only chooses AUTH_MODE at runtime via Compose. Building here lets
# that runtime value bake into the bundle. NODE_OPTIONS raises the V8 heap ceiling
# so the SSR build of ~7400 modules doesn't OOM under Node's ~2GB default.
CMD ["sh", "-c", "echo 'OpenSEO sends an anonymous daily usage heartbeat (counts only). Disable: OPENSEO_TELEMETRY_DISABLED=1. Details: docs/SELF_HOSTING_DOCKER.md#telemetry' && pnpm run db:migrate:local && NODE_OPTIONS=--max-old-space-size=4096 pnpm run build && pnpm exec vite preview --host 0.0.0.0 --port ${PORT:-3001}"]