FROM node:20-alpine AS builder
WORKDIR /app

# Optional: inject a corporate CA cert (e.g. Zscaler) for builds behind TLS inspection.
# Pass base64-encoded PEM via:  --build-arg EXTRA_CA_CERT_B64="$(base64 -w0 zscaler-ca.crt)"
# Leave empty (default) for CI / builds that don't need it.
ARG EXTRA_CA_CERT_B64=""
RUN apk add --no-cache ca-certificates wget && \
    if [ -n "$EXTRA_CA_CERT_B64" ]; then \
      echo "$EXTRA_CA_CERT_B64" | base64 -d > /usr/local/share/ca-certificates/extra-ca.crt && \
      update-ca-certificates; \
    fi
ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

RUN corepack enable && corepack prepare pnpm@10.10.0 --activate
# Copy workspace root files for lockfile
COPY pnpm-workspace.yaml package.json pnpm-lock.yaml .npmrc ./
COPY realtime/package.json ./realtime/
# Install only realtime dependencies
RUN pnpm install --frozen-lockfile --filter realtime
COPY realtime ./realtime
WORKDIR /app/realtime
RUN ../node_modules/.bin/tsc

FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
RUN apk add --no-cache wget
COPY --from=builder /app/realtime/package.json ./package.json
COPY --from=builder /app/realtime/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3001
CMD ["node", "dist/index.js"]