Dockerfile.test

# Make sure RUBY_VERSION matches the Ruby version in .ruby-version and Gemfile
ARG RUBY_VERSION=3.0.3
FROM registry.docker.com/library/ruby:$RUBY_VERSION-slim AS base

# Rails app lives here
WORKDIR /opt/webapps/app

ENV RAILS_ENV="test" \
    RAILS_LOG_TO_STDOUT=true \
    BUNDLE_DEPLOYMENT="1" \
    BUNDLE_PATH="/usr/local/bundle"

# bullseye is EOL: security.debian.org still answers with indices but its pool
# is gone, so apt resolves to the patched versions and then 404s on every .deb.
# archive.debian.org carries no bullseye security suite, so security comes from
# a pinned snapshot mirror, whose Release is past its Valid-Until.
RUN printf '%s\n' \
    'deb http://deb.debian.org/debian bullseye main contrib non-free' \
    'deb http://deb.debian.org/debian bullseye-updates main contrib non-free' \
    'deb http://snapshot.debian.org/archive/debian-security/20260824T000000Z bullseye-security main contrib non-free' \
    > /etc/apt/sources.list \
    && echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99archive

# Throw-away build stage to reduce size of final image
FROM base AS build

# Install packages needed to build gems and node modules
RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y \
    build-essential \
    imagemagick=* \
    shared-mime-info \
    zip \
    unzip \
    curl \
    git \
    gnupg2 \
    libpq-dev \
    libxslt1-dev \
    libxml2-dev \
    libzip-dev \
    ca-certificates \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Install JavaScript dependencies (Using precompiled binaries with dynamic architecture!)
ARG NODE_VERSION=14.21.3
ENV PATH=/usr/local/node/bin:$PATH
RUN ARCH=$(dpkg --print-architecture) && \
    if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; else NODE_ARCH="arm64"; fi && \
    mkdir -p /usr/local/node && \
    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" | tar xz -C /usr/local/node --strip-components=1

# Set up locale
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y locales
RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
RUN sed -i -e 's/# et_EE.UTF-8 UTF-8/et_EE.UTF-8 UTF-8/' /etc/locale.gen && \
    dpkg-reconfigure --frontend=noninteractive locales && \
    update-locale LANG=et_EE.UTF-8
ENV LANG=et_EE.UTF-8

# Install application gems
COPY Gemfile Gemfile.lock ./
RUN gem install bundler && \
    bundle config set --local without 'development staging production' && \
    bundle config set --local frozen true && \
    bundle install && \
    bundle clean --force && \
    rm -rf ${BUNDLE_PATH}/cache/*.gem

# Copy application code
COPY . .

# Copy sample config for asset precompilation (real values come from env at runtime)
RUN cp config/application.yml.sample config/application.yml && \
    cp config/database.yml.sample config/database.yml

# Precompile assets
RUN RAILS_ENV=test SECRET_KEY_BASE=dummy_for_assets \
    ACTION_MAILER_DEFAULT_HOST=dummy.host \
    ACTION_MAILER_DEFAULT_FROM=dummy@example.com \
    bundle exec rails assets:precompile && \
    rm -rf tmp/cache/assets

# Final stage for app image
FROM base

# Install packages needed for deployment (incl. wkhtmltopdf runtime deps)
# Note: Removed dev dependencies like libpq-dev and libzip-dev -> using runtime equivalents if needed
RUN apt-get update -qq && \
    apt-get install --no-install-recommends -y \
    curl \
    git \
    postgresql-client \
    imagemagick=* \
    shared-mime-info \
    locales \
    zip \
    unzip \
    nodejs \
    libxrender1 \
    libxext6 \
    libx11-6 \
    libfontconfig1 \
    libfreetype6 \
    libjpeg62-turbo \
    xfonts-base \
    xfonts-75dpi \
    dnsutils \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Set up locale
RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
RUN sed -i -e 's/# et_EE.UTF-8 UTF-8/et_EE.UTF-8 UTF-8/' /etc/locale.gen && \
    dpkg-reconfigure --frontend=noninteractive locales && \
    update-locale LANG=et_EE.UTF-8
ENV LANG=et_EE.UTF-8

# Copy built artifacts: gems, application
COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
COPY --from=build /opt/webapps/app /opt/webapps/app

# Run and own only the runtime files as a non-root user for security
RUN groupadd --system --gid 1000 rails && \
    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
    mkdir -p db log tmp && \
    chown -R rails:rails /opt/webapps/app

# Fix permissions for wkhtmltopdf-binary gem (run as root before switching user)
RUN chmod +x /usr/local/bundle/ruby/*/gems/wkhtmltopdf-binary-*/bin/wkhtmltopdf* 2>/dev/null || true && \
    chown -R 1000:1000 /usr/local/bundle/ruby/*/gems/wkhtmltopdf-binary-*/bin/ 2>/dev/null || true

# Direct copy with chown to avoid root permissions on the file
COPY --chown=1000:1000 config/application.yml.sample config/application.yml

USER 1000:1000

# Entrypoint prepares the database.
# ENTRYPOINT ["/opt/webapps/app/bin/docker-entrypoint"]

# Expose port
EXPOSE 3000

# Start the application
CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"]