Dockerfile

# Stage 1 - Install dependencies
FROM oven/bun:1.3.6-alpine AS deps
WORKDIR /app

COPY package.json bun.lock ./
COPY apps/api/package.json apps/api/
COPY apps/web/package.json apps/web/
COPY apps/desktop/package.json apps/desktop/
COPY packages/db/package.json packages/db/
COPY packages/api-spec/package.json packages/api-spec/
COPY packages/api-client-react/package.json packages/api-client-react/
COPY packages/api-zod/package.json packages/api-zod/
COPY packages/desktop-db/package.json packages/desktop-db/
COPY packages/desktop-api/package.json packages/desktop-api/

# Skip the desktop-only workspaces: Railway runs the web API, not Tauri.
# The package.json files above are copied so `bun install --frozen-lockfile`
# can reconcile bun.lock, but we don't need their node_modules in production.
RUN bun install --frozen-lockfile \
  --ignore-scripts

# Stage 2 - Build frontend
FROM deps AS builder
WORKDIR /app

COPY . .
RUN bun run --filter @workspace/web build

# Stage 3 - Production
FROM oven/bun:1.3.6-alpine AS production
WORKDIR /app

COPY --from=deps /app/node_modules ./node_modules

COPY --from=builder /app/package.json ./
COPY --from=builder /app/apps/api ./apps/api
COPY --from=builder /app/apps/web/dist ./apps/web/dist
COPY --from=builder /app/packages ./packages

RUN mkdir -p /app/apps/api/uploads && chown bun:bun /app/apps/api/uploads

COPY entrypoint.sh ./
RUN chmod +x entrypoint.sh

ENV NODE_ENV=production
EXPOSE 3001

HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
  CMD wget -qO- http://localhost:3001/api/healthz || exit 1

USER bun
CMD ["./entrypoint.sh"]