# Bulwark Lite as a container: the static export behind an unprivileged nginx,
# no Node.js at runtime. Mount your own config.json (and policy.json) over the
# ones in /usr/share/nginx/html to configure it - see README.md, "Static Lite
# build".
#
#   docker build -f Dockerfile.lite -t bulwark-lite .

# The export is plain files, so it is built once on the build host's
# architecture, whatever the target platform is.
FROM --platform=$BUILDPLATFORM node:24-alpine AS builder
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
ENV NEXT_TELEMETRY_DISABLED=1
# scripts/lite/prepare.mjs deletes the server-only trees in place; this layer
# is disposable, which is what CI=true asserts.
ENV CI=true
# Defaults baked into config.json; every one of them can still be changed by
# mounting a config.json. No NEXT_PUBLIC_BASE_PATH: the image serves from /.
ARG LITE_JMAP_SERVER_URL=
ARG LITE_APP_NAME=
ARG LITE_ALLOW_CUSTOM_ENDPOINT=
ARG LITE_REMEMBER_ME=
ARG LITE_DEMO_MODE=
# Comma-separated locale subset, e.g. en,de (default: all).
ARG LITE_LOCALES=
ARG NEXT_PUBLIC_DEFAULT_LOCALE=
# Commit SHA shown in the About screen. .dockerignore excludes .git, so CI
# must pass it in.
ARG GIT_COMMIT=unknown
RUN LITE_TARGET=static NEXT_PUBLIC_BASE_PATH= npm run build:lite && \
    node scripts/lite/container.mjs /image

FROM nginxinc/nginx-unprivileged:1.30-alpine-slim

LABEL org.opencontainers.image.title="Bulwark Webmail Lite"
LABEL org.opencontainers.image.description="Bulwark Webmail as static files behind nginx; talks to the JMAP server straight from the browser"
LABEL org.opencontainers.image.source="https://github.com/bulwarkmail/webmail"
LABEL org.opencontainers.image.url="https://github.com/bulwarkmail/webmail"
LABEL org.opencontainers.image.licenses="AGPL-3.0-only"
LABEL org.opencontainers.image.vendor="rbm.systems"

# connect-src of the Content-Security-Policy. Set it to your JMAP server's
# origin (e.g. https://mail.example.com) once config.json pins the server.
ENV LITE_CSP_CONNECT_SRC="*"
# Only LITE_* is substituted into the nginx template, never nginx's own $uri etc.
ENV NGINX_ENVSUBST_FILTER="^LITE_"

# COPY only: no command runs in this stage, so other platforms build without emulation.
COPY --from=builder --chmod=0755 /app/scripts/lite/container/15-lite-listen-ipv6.envsh /docker-entrypoint.d/
COPY --from=builder /image/default.conf.template /etc/nginx/templates/default.conf.template
COPY --from=builder /image/html/ /usr/share/nginx/html/

EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:8080/lite-build.json || exit 1