# syntax=docker/dockerfile:1.7

ARG PYTHON_IMAGE=python:3.12.13-slim-bookworm@sha256:d50fb7611f86d04a3b0471b46d7557818d88983fc3136726336b2a4c657aa30b
ARG NODE_IMAGE=node:20.19.4-bookworm-slim@sha256:6db5e436948af8f0244488a1f658c2c8e55a3ae51ca2e1686ed042be8f25f70a
ARG XRAY_VERSION=v26.3.27

FROM ${NODE_IMAGE} AS dashboard
WORKDIR /dashboard

COPY app/dashboard/package.json app/dashboard/package-lock.json ./
RUN npm ci

COPY app/dashboard/ ./
RUN VITE_BASE_API=/api/ npm run build -- --outDir build --assetsDir statics \
    && cp build/index.html build/404.html


FROM ${PYTHON_IMAGE} AS dependencies
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONDONTWRITEBYTECODE=1
WORKDIR /build

RUN apt-get update \
    && apt-get install --yes --no-install-recommends \
       build-essential \
       gcc \
       libffi-dev \
       libssl-dev \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt ./
RUN python -m pip install --upgrade pip==26.1.2 \
    && python -m pip install --prefix=/install --no-cache-dir \
       --requirement requirements.txt


FROM ${PYTHON_IMAGE} AS xray
ARG TARGETARCH
ARG XRAY_VERSION

RUN apt-get update \
    && apt-get install --yes --no-install-recommends ca-certificates curl unzip \
    && rm -rf /var/lib/apt/lists/* \
    && set -eux; \
       case "${TARGETARCH}" in \
         amd64) \
           asset="Xray-linux-64.zip"; \
           checksum="23cd9af937744d97776ee35ecad4972cf4b2109d1e0fe6be9930467608f7c8ae" \
           ;; \
         arm64) \
           asset="Xray-linux-arm64-v8a.zip"; \
           checksum="4d30283ae614e3057f730f67cd088a42be6fdf91f8639d82cb69e48cde80413c" \
           ;; \
         *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
       esac; \
       curl --fail --show-error --silent --location \
         "https://github.com/XTLS/Xray-core/releases/download/${XRAY_VERSION}/${asset}" \
         --output /tmp/xray.zip; \
       echo "${checksum}  /tmp/xray.zip" | sha256sum --check --strict; \
       mkdir -p /opt/xray/bin /opt/xray/share; \
       unzip -q /tmp/xray.zip -d /tmp/xray; \
       install -m 0755 /tmp/xray/xray /opt/xray/bin/xray; \
       install -m 0644 /tmp/xray/geoip.dat /tmp/xray/geosite.dat /opt/xray/share/


FROM ${PYTHON_IMAGE} AS runtime
ARG BUILD_VERSION=1.0.0-beta.1
ARG VCS_REF=unknown
ARG SOURCE_URL=""

LABEL org.opencontainers.image.title="Bach Khoa VPN" \
      org.opencontainers.image.description="Commercial VPN control plane" \
      org.opencontainers.image.version="${BUILD_VERSION}" \
      org.opencontainers.image.revision="${VCS_REF}" \
      org.opencontainers.image.source="${SOURCE_URL}" \
      org.opencontainers.image.licenses="AGPL-3.0-only"

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1
WORKDIR /code

RUN apt-get update \
    && apt-get install --yes --no-install-recommends bash ca-certificates \
    && rm -rf /var/lib/apt/lists/*

COPY --from=dependencies /install /usr/local
COPY --from=xray /opt/xray/bin/xray /usr/local/bin/xray
COPY --from=xray /opt/xray/share/ /usr/local/share/xray/
COPY . /code
COPY --from=dashboard /dashboard/build/ /code/app/dashboard/build/

RUN ln -s /code/marzban-cli.py /usr/local/bin/marzban-cli \
    && chmod 0755 /code/marzban-cli.py

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
    CMD python -c "import os,urllib.request; urllib.request.urlopen('http://127.0.0.1:' + os.getenv('UVICORN_PORT', '8000') + '/ready', timeout=3).read()"

# A failed migration must stop the container; starting against a partially
# upgraded schema is never an acceptable fallback.
CMD ["bash", "-c", "alembic upgrade head && exec python /code/main.py"]
