# warp-aio-postgresql — the homeserver, the admin panel, the web client
# and PostgreSQL 17 in one image. PostgreSQL listens only on a Unix socket
# inside the container, with its data in /data/postgres; see entrypoint.sh.
# To use a PostgreSQL elsewhere instead, set WARP_AIO_EMBEDDED_POSTGRES=false
# and WARP_DB_CONNECTION_STRING to its DSN.
#
# Build from the repository root:
#
#   docker build -t warp-aio-postgresql -f Docker-AIO/Dockerfile.PostgreSQL .
#   docker run -p 8008:8008 -p 8009:8009 -p 8080:8080 -v warp-data:/data \
#     -e WARP_SERVER_NAME=warp.example warp-aio-postgresql
#
# The database, signing key and media live in /data; mount a volume on it.

FROM node:22-alpine AS web

WORKDIR /src
RUN corepack enable

# Lockfile and manifests first, so the package store survives source changes.
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
COPY apps/ui/package.json ./apps/ui/
COPY apps/admin/package.json ./apps/admin/
COPY apps/web/package.json ./apps/web/
RUN pnpm install --frozen-lockfile --filter @warp/admin... --filter @warp/web...

COPY apps/ui ./apps/ui
COPY apps/admin ./apps/admin
COPY apps/web ./apps/web
RUN pnpm --filter @warp/admin build && pnpm --filter @warp/web build


FROM golang:1.26-alpine AS build

ARG VERSION=0.0.0-dev
ARG COMMIT=unknown
ARG BUILD_DATE=unknown
ENV CGO_ENABLED=0

WORKDIR /src

# The homeserver. Dependencies first, so the module cache survives source
# changes.
COPY server/go.mod server/go.sum ./server/
RUN cd server && go mod download
COPY server ./server
RUN cd server && go build -trimpath \
    -ldflags "-s -w \
      -X github.com/dariuszjaniak/warp/server/internal/buildinfo.Version=${VERSION} \
      -X github.com/dariuszjaniak/warp/server/internal/buildinfo.Commit=${COMMIT} \
      -X github.com/dariuszjaniak/warp/server/internal/buildinfo.BuildDate=${BUILD_DATE}" \
    -o /out/warp ./cmd/warp

# The admin panel and the web client, each with its frontend embedded.
COPY apps/admin/go.mod ./apps/admin/
COPY apps/admin/cmd ./apps/admin/cmd
COPY apps/admin/internal ./apps/admin/internal
COPY --from=web /src/apps/admin/internal/panel/build/dist ./apps/admin/internal/panel/build/dist
RUN cd apps/admin && GOWORK=off go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" \
    -o /out/warp-admin ./cmd/warp-admin

COPY apps/web/go.mod ./apps/web/
COPY apps/web/cmd ./apps/web/cmd
COPY apps/web/host ./apps/web/host
COPY apps/web/client/client.go ./apps/web/client/
COPY --from=web /src/apps/web/client/build/dist ./apps/web/client/build/dist
RUN cd apps/web && GOWORK=off go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" \
    -o /out/warp-web ./cmd/warp-web


FROM alpine:3.21

# tini is PID 1 so signals reach the entrypoint and zombies are reaped.
# PostgreSQL runs as the same unprivileged user as everything else.
RUN apk add --no-cache ca-certificates tzdata curl tini postgresql17 postgresql17-client && \
    adduser -D -u 10001 -h /data warp && \
    mkdir -p /run/postgresql && chown warp:warp /run/postgresql

COPY --from=build /out/warp /out/warp-admin /out/warp-web /usr/local/bin/
COPY warp.yaml.example /etc/warp/warp.yaml.example
COPY --chmod=755 Docker-AIO/entrypoint.sh /usr/local/bin/warp-aio

# Database, signing key and media live here; mount a volume on it.
WORKDIR /data
RUN chown warp:warp /data
USER warp

ENV WARP_LISTEN_ADDRESS=":8008" \
    WARP_PRIVATE_KEY="/data/signing.key" \
    WARP_DB_DRIVER="postgres" \
    WARP_DB_CONNECTION_STRING="postgres:///warp?host=/run/postgresql&user=warp&sslmode=disable" \
    WARP_MEDIA_BASE_PATH="/data/media" \
    WARP_LOG_FORMAT="json" \
    WARP_ADMIN_LISTEN=":8009" \
    WARP_ADMIN_HOMESERVER="http://127.0.0.1:8008" \
    WARP_ADMIN_LOG_FORMAT="json" \
    WARP_WEB_LISTEN=":8080" \
    WARP_WEB_HOMESERVER="http://127.0.0.1:8008" \
    WARP_WEB_LOG_FORMAT="json" \
    WARP_AIO_ADMIN="true" \
    WARP_AIO_WEB="true" \
    WARP_AIO_EMBEDDED_POSTGRES="true"

EXPOSE 8008 8009 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD curl -fsS http://127.0.0.1:8008/healthz && \
        { [ "$WARP_AIO_ADMIN" != true ] || curl -fsS http://127.0.0.1:8009/healthz; } && \
        { [ "$WARP_AIO_WEB" != true ] || curl -fsS http://127.0.0.1:8080/healthz; } || exit 1

ENTRYPOINT ["/sbin/tini", "--", "warp-aio"]