FROM node:24-alpine AS frontend
WORKDIR /src/web
COPY web/package*.json ./
RUN npm ci
COPY web/ ./
RUN npm run build

FROM golang:1.26-alpine AS backend
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
COPY --from=frontend /src/web/dist ./web/dist
RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /ai-router .

FROM alpine:3.23
RUN apk add --no-cache ca-certificates && addgroup -g 10001 router && adduser -D -u 10001 -G router router
WORKDIR /app
RUN mkdir /app/data && chown router:router /app/data
COPY --from=backend /ai-router /usr/local/bin/ai-router
USER router
EXPOSE 8080
ENTRYPOINT ["ai-router", "-config", "/app/config.yaml"]