Dockerfile

# Frontend build stage
FROM oven/bun:1-alpine AS frontend-builder
WORKDIR /app
COPY frontend/package.json frontend/bun.lock ./
RUN bun install --frozen-lockfile
COPY frontend/ ./
RUN bun run build

# Backend build stage
FROM golang:1.25-alpine AS builder

WORKDIR /app

# Install protoc and plugins for proto generation
# Versions pinned to match go.mod (connectrpc.com/connect v1.20.0, google.golang.org/protobuf v1.36.11)
RUN apk add --no-cache protobuf protobuf-dev
RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11
RUN go install connectrpc.com/connect/cmd/protoc-gen-connect-go@v1.20.0

# Copy go mod files first for caching
COPY backend/go.mod backend/go.sum ./backend/
RUN cd backend && go mod download

# Copy proto and generate
COPY proto/ ./proto/
RUN mkdir -p backend/pkg/proto
RUN protoc --go_out=backend/pkg/proto --go_opt=paths=source_relative \
    --connect-go_out=backend/pkg/proto --connect-go_opt=paths=source_relative \
    -I proto proto/*.proto

# Copy backend source and build
COPY backend/ ./backend/
RUN cd backend && CGO_ENABLED=0 GOOS=linux go build -o /app/server ./cmd/server

# Runtime stage
FROM alpine:3.22

WORKDIR /app

# Create non-root user
RUN adduser -D -u 1000 splitwiser

# Copy binary
COPY --from=builder /app/server /app/server

# Copy static files (built by frontend-builder stage)
COPY --from=frontend-builder /app/static/ /app/frontend/static/

# Create data directory and set permissions
RUN mkdir -p /app/data && chown -R splitwiser:splitwiser /app

USER splitwiser

# Set environment variables for paths
ENV DB_PATH=/app/data/bills.db
ENV STATIC_PATH=/app/frontend/static

# Production configuration (uncomment/override):
# ENV JWT_SECRET=change-me-to-a-strong-random-string
# ENV CORS_ORIGIN=https://your-domain.com
# ENV TLS_CERT_FILE=/app/certs/cert.pem
# ENV TLS_KEY_FILE=/app/certs/key.pem
# ENV PORT=8080

EXPOSE 8080

# Volume for SQLite database
VOLUME ["/app/data"]

CMD ["/app/server"]