# nibe_datamanager/Dockerfile — the Yii2 data-bridge backend.
#
# Identical in shape to the other backends: it inherits the shared php-nginx base image,
# which supplies php-fpm, nginx and supervisor, and serves /app/web on port 80. nibe's
# docroot is web/, so port 80 is the right one with no nginx change.
ARG BASE_IMAGE

# ---------------------------------------------------------------- dependency stage
# Composer deps are installed here, not shipped in a committed vendor/ folder — no
# vendor/ has ever existed in this repo. See the note on --no-scripts below.
FROM ${BASE_IMAGE} AS deps
COPY --from=public.ecr.aws/composer/composer:2-bin /composer /usr/bin/composer
WORKDIR /app
COPY composer.json composer.lock ./
# --no-scripts is mandatory: composer.json declares
#   post-install-cmd -> yii\composer\Installer::postInstall
#   extra.generateCookieValidationKey -> ["config/web.php"]
# and this service reads COOKIE_VALIDATION_KEY from the environment (config/web.php),
# injected from Secrets Manager. Letting the script run would overwrite that file with
# a fresh random key on every build.
RUN composer install --no-dev --no-scripts --no-progress --no-interaction \
                     --optimize-autoloader --prefer-dist \
 && composer clear-cache

# ---------------------------------------------------------------- runtime stage
FROM ${BASE_IMAGE}

# App code. .dockerignore keeps nibedatamanager_fe/ and demo/ out: the frontend is a
# separate image, and demo/ is 83 MB of generated Angular output.
COPY . /app
COPY --from=deps /app/vendor /app/vendor

# Yii needs runtime/ and the asset publish dir to EXIST and be writable. Neither is
# tracked in git (and .dockerignore excludes them), so a plain `COPY . /app` produces an
# image without them and the app fatals on its first log write.
RUN set -eux; \
    mkdir -p /app/runtime/logs /app/runtime/cache /app/web/assets; \
    chown -R www-data:www-data /app/runtime /app/web/assets; \
    chmod -R 775 /app/runtime /app/web/assets

EXPOSE 80 81 82 83 84