# k3s / Kaniko：静态 SPA（方案 A）。TLS 由 Traefik(websecure) + cert-manager 终结。
# API 由浏览器按站点域名直连：
#   test.ideship.com → api.test.ideship.com；其余 → api.ideship.com
# FRONT_BUILD_SCRIPT：
#   prod 默认 build（.env.production → api.ideship.com）
#   test 传 build:test（.env.ideship-test → api.test.ideship.com）
# 即使误用 production 构建，运行时也会按 hostname 纠正到测试 API。
FROM docker.m.daocloud.io/library/node:20-alpine AS build
WORKDIR /app
ARG FRONT_BUILD_SCRIPT=build
RUN npm config set registry https://registry.npmmirror.com \
  && npm install -g pnpm@9.15.9
COPY package.json pnpm-lock.yaml ./
# --ignore-scripts：跳过 gifsicle/optipng 等原生编译（需 autoreconf；vite 未启用 imagemin）
RUN pnpm config set registry https://registry.npmmirror.com \
  && pnpm install --frozen-lockfile --ignore-scripts
COPY . .
RUN pnpm run ${FRONT_BUILD_SCRIPT}

# 仅静态托管 + SPA fallback；不再内置 nginx（网关层 Traefik 负责 HTTPS）
FROM docker.m.daocloud.io/library/node:20-alpine
WORKDIR /app
RUN npm config set registry https://registry.npmmirror.com \
  && npm install -g serve@14.2.4
COPY --from=build /app/dist ./dist
EXPOSE 80
CMD ["serve", "-s", "dist", "-l", "80"]