# syntax=docker/dockerfile:1.7

ARG NODE_IMAGE=public.ecr.aws/docker/library/node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293
ARG NGINX_IMAGE=quay.io/nginx/nginx-unprivileged:alpine-slim@sha256:98edb4ebb9aae4d8ff4bd2ea5edc9939cc2f7cd206a20644928ada32a657c052

FROM ${NODE_IMAGE} AS builder

ARG BENTOPDF_VERSION=2.8.7
ARG BENTOPDF_COMMIT=55915a29017a5090a6ea61e61b0f4d899f032923
ARG BENTOPDF_ARCHIVE_SHA256=b744127e326d4f2ba414b71d7fcb80fdf6bab519d2f70fd841500fca63374be1
ARG PDFJS_VERSION=5.4.296
ARG PDFJS_ARCHIVE_SHA256=01f7da2d0983256b7d9f8dde9d99e94479f075e30bc571b69cafc92bf419cee2
ARG PDFJS_LICENSE_SHA256=0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
ARG NODABLE_ENTITIES_LICENSE_SHA256=750cb3fb6362804957ef52caaf9b5c824015be44d494637330d7cd8834d31d40
ARG XML_NAMING_LICENSE_SHA256=8e75fc0e776c62ccadb8178ece8d3daa9ba7601fb0a49b2dfb0ea9a7a5c0aa07
ARG ISARRAY_README_SHA256=ff138e683771b187f3629c383db72ee7d632009010a36d08e18e8d2a34222ec7

WORKDIR /app

ADD --checksum=sha256:${BENTOPDF_ARCHIVE_SHA256} \
    https://github.com/alam00000/bentopdf/archive/${BENTOPDF_COMMIT}.tar.gz \
    /tmp/bentopdf-source.tar.gz
ADD --checksum=sha256:${PDFJS_ARCHIVE_SHA256} \
    https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-${PDFJS_VERSION}.tgz \
    /app/third-party-source/pdfjs-dist-${PDFJS_VERSION}.tgz
ADD --checksum=sha256:${PDFJS_LICENSE_SHA256} \
    https://raw.githubusercontent.com/mozilla/pdf.js/v${PDFJS_VERSION}/LICENSE \
    /app/PDFJS-LICENSE.txt
ADD --checksum=sha256:${NODABLE_ENTITIES_LICENSE_SHA256} \
    https://raw.githubusercontent.com/nodable/val-parsers/f1c61a65e7b967c17b13822ef71e91bd25f17ce2/LICENSE \
    /app/NODABLE-ENTITIES-LICENSE.txt
ADD --checksum=sha256:${XML_NAMING_LICENSE_SHA256} \
    https://raw.githubusercontent.com/NaturalIntelligence/xml-naming/c0afc395948730bed124859d7fc7cccabe0aac8a/LICENSE \
    /app/XML-NAMING-LICENSE.txt
ADD --checksum=sha256:${ISARRAY_README_SHA256} \
    https://raw.githubusercontent.com/juliangruber/isarray/2a23a281f369e9ae06394c0fb4d2381355a6ba33/README.md \
    /app/ISARRAY-README.md

RUN tar -xzf /tmp/bentopdf-source.tar.gz --strip-components=1 -C /app \
    && rm /tmp/bentopdf-source.tar.gz \
    && test "$(node -p "require('./package.json').version")" = "${BENTOPDF_VERSION}" \
    && apk add --no-cache imagemagick

COPY branding /branding
COPY Dockerfile compose.yaml README.md nginx.conf security-headers.conf /deployment/

RUN node /branding/apply-branding.mjs \
    && magick public/images/aimbit-mark-source.png -background none -gravity center -resize 184x184 -extent 192x192 public/images/favicon-192x192.png \
    && magick public/images/aimbit-mark-source.png -background none -gravity center -resize 496x496 -extent 512x512 public/images/favicon-512x512.png \
    && magick public/images/aimbit-mark-source.png -background none -gravity center -resize 172x172 -extent 180x180 public/images/apple-touch-icon.png \
    && magick public/images/aimbit-mark-source.png -background none -gravity center -resize 48x48 -extent 48x48 -define icon:auto-resize=48,32,16 public/favicon.ico \
    && npm config set fetch-retries 5 \
    && npm config set fetch-retry-mintimeout 30000 \
    && npm config set fetch-retry-maxtimeout 180000 \
    && npm config set fetch-timeout 600000 \
    && npm install --package-lock-only --ignore-scripts

ENV HUSKY=0 \
    NODE_OPTIONS=--max-old-space-size=3072 \
    SIMPLE_MODE=true \
    COMPRESSION_MODE=all \
    BASE_URL=/ \
    VITE_DEFAULT_LANGUAGE=de \
    VITE_BRAND_NAME="aimbit PDF" \
    VITE_BRAND_LOGO=images/aimbit-mark.svg \
    VITE_FOOTER_TEXT="Bereitgestellt von aimbit" \
    SITE_URL=https://pdf.aimbit.de

RUN npm ci \
    && node /branding/patch-installed-dependencies.mjs \
    && npm audit --omit=dev --audit-level=high \
    && node /branding/generate-node-notices.mjs /app/THIRD_PARTY_NODE_LICENSES.md \
    && mkdir -p /app/aimbit-deployment \
    && cp -a /deployment/. /app/aimbit-deployment/ \
    && cp -a /branding /app/aimbit-deployment/branding \
    && tar \
      --exclude='./node_modules' \
      --exclude='./dist' \
      -czf /tmp/aimbit-pdf-source-${BENTOPDF_VERSION}-aimbit.8.tar.gz . \
    && disabled_tools="$(awk 'NF && $1 !~ /^#/ { if (out) out=out ","; out=out $1 } END { print out }' /branding/disabled-tools.txt)" \
    && export DISABLE_TOOLS="${disabled_tools}" VITE_DISABLED_TOOLS="${disabled_tools}" \
    && npm run build

RUN node /branding/post-build.mjs /app/dist

FROM ${NGINX_IMAGE} AS runtime

ARG BENTOPDF_VERSION=2.8.7
ARG BENTOPDF_COMMIT=55915a29017a5090a6ea61e61b0f4d899f032923
ARG BUILD_DATE=2026-08-10T00:00:00Z

LABEL org.opencontainers.image.title="aimbit PDF Werkzeugkasten" \
      org.opencontainers.image.description="Datenschutzfreundliche PDF-Werkzeuge mit Verarbeitung im Browser" \
      org.opencontainers.image.version="2.8.7-aimbit.8" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.authors="aimbit GmbH" \
      org.opencontainers.image.vendor="aimbit GmbH" \
      org.opencontainers.image.revision="${BENTOPDF_COMMIT}" \
      org.opencontainers.image.url="https://pdf.aimbit.de/" \
      org.opencontainers.image.source="https://pdf.aimbit.de/quellcode/" \
      org.opencontainers.image.licenses="AGPL-3.0-only"

USER root
RUN rm -rf /etc/nginx/conf.d /docker-entrypoint.d \
    && rm -f /usr/share/nginx/html/50x.html \
    && mkdir -p /usr/share/nginx/html/quellcode \
    && chown -R nginx:nginx /usr/share/nginx/html

COPY --chown=nginx:nginx --from=builder /app/dist/ /usr/share/nginx/html/
RUN rm -f /usr/share/nginx/html/50x.html \
    && test ! -e /usr/share/nginx/html/50x.html
COPY --chown=nginx:nginx branding/50x.html /usr/share/nginx/html/50x.html
COPY --chown=nginx:nginx --from=builder /app/dist/quellcode.html /usr/share/nginx/html/quellcode/index.html
COPY --chown=nginx:nginx --from=builder /app/AIMBIT-CHANGES.md /usr/share/nginx/html/quellcode/AIMBIT-CHANGES.md
COPY --chown=nginx:nginx --from=builder /app/TRADEMARKS.md /usr/share/nginx/html/quellcode/TRADEMARKS.md
COPY --chown=nginx:nginx --from=builder /app/THIRD_PARTY_NOTICES.md /usr/share/nginx/html/quellcode/THIRD_PARTY_NOTICES.md
COPY --chown=nginx:nginx --from=builder /app/PDFJS-LICENSE.txt /usr/share/nginx/html/quellcode/PDFJS-LICENSE.txt
COPY --chown=nginx:nginx --from=builder /app/THIRD_PARTY_NODE_LICENSES.md /usr/share/nginx/html/quellcode/THIRD_PARTY_NODE_LICENSES.md
COPY --chown=nginx:nginx --from=builder /app/NODABLE-ENTITIES-LICENSE.txt /usr/share/nginx/html/quellcode/NODABLE-ENTITIES-LICENSE.txt
COPY --chown=nginx:nginx --from=builder /app/XML-NAMING-LICENSE.txt /usr/share/nginx/html/quellcode/XML-NAMING-LICENSE.txt
COPY --chown=nginx:nginx --from=builder /app/ISARRAY-README.md /usr/share/nginx/html/quellcode/ISARRAY-README.md
COPY --chown=nginx:nginx --from=builder /branding/SIGNATURE-FONTS-OFL.txt /usr/share/nginx/html/quellcode/SIGNATURE-FONTS-OFL.txt
COPY --chown=nginx:nginx --from=builder \
    /tmp/aimbit-pdf-source-${BENTOPDF_VERSION}-aimbit.8.tar.gz \
    /usr/share/nginx/html/quellcode/aimbit-pdf-source-${BENTOPDF_VERSION}-aimbit.8.tar.gz
COPY --chown=nginx:nginx nginx.conf /etc/nginx/nginx.conf
COPY --chown=nginx:nginx security-headers.conf /etc/nginx/security-headers.conf

USER nginx
EXPOSE 8080

ENTRYPOINT []
CMD ["nginx", "-g", "daemon off;"]
