FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src

COPY Directory.Build.props ./
COPY src/EntKube.Web/EntKube.Web.csproj src/EntKube.Web/
COPY src/EntKube.Web.Client/EntKube.Web.Client.csproj src/EntKube.Web.Client/
RUN dotnet restore src/EntKube.Web/EntKube.Web.csproj

COPY src/ src/
RUN dotnet publish src/EntKube.Web/EntKube.Web.csproj \
    --no-restore \
    -c Release \
    -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
WORKDIR /app

# libgit2sharp bundles its native lib, but needs libssl/libcurl on Debian
RUN apt-get update && apt-get install -y --no-install-recommends \
    libssl3 \
    libcurl4 \
    && rm -rf /var/lib/apt/lists/*

# Run as non-root
RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
RUN mkdir -p /app/Data && chown appuser:appgroup /app/Data

COPY --from=build /app/publish .
RUN chown -R appuser:appgroup /app

USER appuser

ENV ASPNETCORE_URLS=http://+:8080
ENV ASPNETCORE_ENVIRONMENT=Production

# SQLite database lives here — mount a persistent volume at /app/Data
VOLUME ["/app/Data"]

EXPOSE 8080

ENTRYPOINT ["dotnet", "EntKube.Web.dll"]