"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.generateFrontendDockerfile = generateFrontendDockerfile;
function generateFrontendDockerfile({ schema: { projectType, slug } }) {
    const isWorkspace = projectType === 'workspace';
    const directory = isWorkspace ? `projects/${slug}/` : '';
    return generateDockerfile({ directory, slug, isWorkspace });
}
const generateDockerfile = ({ directory, slug, isWorkspace, }) => /*Dockerfile*/ String.raw `# Step 1. Rebuild the source code only when needed
FROM node:24 AS base
RUN npm i -g --ignore-scripts pnpm${isWorkspace ? '' : ' turbo@^2'}

FROM base AS installer
WORKDIR /app

# Install dependencies
COPY json/ .
RUN pnpm i --frozen-lockfile --ignore-scripts

WORKDIR /app
# Copy source files
COPY full/ .

# Set Turborepo environment variables
ENV TURBO_API=https://turborepo-cache.postxl.com
ENV TURBO_TEAM=postxl

# Safely use Turborepo secret according to https://docs.docker.com/build/building/secrets/
RUN --mount=type=secret,id=TURBO_TOKEN \
  VITE_PUBLIC_API_URL=PLACEHOLDER_VITE_PUBLIC_API_URL VITE_PUBLIC_BASE_URL=PLACEHOLDER_VITE_PUBLIC_BASE_URL \
  VITE_PUBLIC_MAPBOX_ACCESS_TOKEN=PLACEHOLDER_VITE_PUBLIC_MAPBOX_ACCESS_TOKEN VITE_PUBLIC_ENABLE_ANALYTICS=PLACEHOLDER_VITE_PUBLIC_ENABLE_ANALYTICS \
  VITE_PUBLIC_ANALYTICS_SCRIPT_URL=PLACEHOLDER_VITE_PUBLIC_ANALYTICS_SCRIPT_URL VITE_PUBLIC_KEYCLOAK_URL=PLACEHOLDER_VITE_PUBLIC_KEYCLOAK_URL \
  VITE_PUBLIC_KEYCLOAK_CLIENT_ID=PLACEHOLDER_VITE_PUBLIC_KEYCLOAK_CLIENT_ID VITE_PUBLIC_KEYCLOAK_REALM=PLACEHOLDER_VITE_PUBLIC_KEYCLOAK_REALM \
  VITE_PUBLIC_CHECK_LOGIN_IFRAME=PLACEHOLDER_VITE_PUBLIC_CHECK_LOGIN_IFRAME \
  pnpm ${isWorkspace ? `turbo:ci build --filter=@postxl/${slug} --filter=@postxl/${slug}-frontend --filter=@postxl/${slug}-api` : `turbo run build --filter=@postxl/${slug}-frontend --filter=@postxl/${slug}-api`}

# Step 2. Production image, copy all the files and run nginx
FROM node:24-alpine AS runner

RUN apk add --no-cache nginx=~1.28

WORKDIR /app

# Fix Nginx permissions: create and chown log, temp, and run dirs before switching user
RUN mkdir -p /var/lib/nginx/tmp /var/lib/nginx/logs /var/log/nginx /run/nginx \
  && chown -R nginx:nginx /var/lib/nginx /var/log/nginx /run/nginx

COPY --from=installer /app/${directory}frontend/public ./frontend/public

# Only copy dist directory
COPY --from=installer /app/${directory}frontend/dist ./frontend/dist

# Copy nginx config
COPY /full/${isWorkspace ? `${directory}docker/` : ''}frontend/frontend.conf /etc/nginx/http.d/default.conf

# Set ownership for all files to nginx
# Restrict permissions only for frontend app code, keep dependencies writable
RUN chown -R nginx:nginx /app \
  && find /app/frontend -type d -exec chmod 755 {} + \
  && find /app/frontend -type f -exec chmod 444 {} +

WORKDIR /app/frontend

COPY /full/${isWorkspace ? `${directory}docker/` : ''}frontend/entrypoint.sh ./entrypoint.sh
RUN chown nginx:nginx ./entrypoint.sh && chmod +x ./entrypoint.sh

# Don't run production as root
USER nginx

# The script will replace the env placeholders with the actual env values
ENTRYPOINT ["./entrypoint.sh"]

CMD ["nginx", "-g", "daemon off;"]
`;
//# sourceMappingURL=frontend-dockerfile.generator.js.map