# SEO Image Renamer Worker Service Dockerfile
FROM node:18-alpine AS base

# Install system dependencies for image processing and virus scanning
RUN apk add --no-cache \
    python3 \
    make \
    g++ \
    cairo-dev \
    jpeg-dev \
    pango-dev \
    musl-dev \
    giflib-dev \
    pixman-dev \
    pangomm-dev \
    libjpeg-turbo-dev \
    freetype-dev \
    clamav \
    clamav-daemon \
    freshclam \
    && rm -rf /var/cache/apk/*

# Set working directory
WORKDIR /app

# Copy package files
COPY package*.json ./
COPY tsconfig.json ./
COPY nest-cli.json ./

# Install dependencies
FROM base AS dependencies
RUN npm ci --only=production && npm cache clean --force

# Install dev dependencies for building
FROM base AS build-dependencies
RUN npm ci

# Build the application
FROM build-dependencies AS build
COPY src/ ./src/
RUN npm run build

# Production image
FROM base AS production

# Create non-root user for security
RUN addgroup -g 1001 -S worker && \
    adduser -S worker -u 1001 -G worker

# Copy production dependencies
COPY --from=dependencies /app/node_modules ./node_modules

# Copy built application
COPY --from=build /app/dist ./dist
COPY --from=build /app/package*.json ./

# Create required directories
RUN mkdir -p /tmp/seo-worker /app/logs && \
    chown -R worker:worker /tmp/seo-worker /app/logs /app

# Configure ClamAV
RUN mkdir -p /var/lib/clamav /var/log/clamav && \
    chown -R clamav:clamav /var/lib/clamav /var/log/clamav && \
    chmod 755 /var/lib/clamav /var/log/clamav

# Copy ClamAV configuration
COPY <<EOF /etc/clamav/clamd.conf
LocalSocket /var/run/clamav/clamd.sock
LocalSocketGroup clamav
LocalSocketMode 666
User clamav
AllowSupplementaryGroups true
ScanMail true
ScanArchive true
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogSyslog false
LogRotate true
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PreludeEnable no
PreludeAnalyzerName ClamAV
DatabaseDirectory /var/lib/clamav
OfficialDatabaseOnly false
SelfCheck 3600
Foreground false
Debug false
ScanPE true
ScanELF true
ScanOLE2 true
ScanPDF true
ScanSWF true
ScanHTML true
MaxScanSize 100M
MaxFileSize 25M
MaxRecursion 16
MaxFiles 10000
MaxEmbeddedPE 10M
MaxHTMLNormalize 10M
MaxHTMLNoTags 2M
MaxScriptNormalize 5M
MaxZipTypeRcg 1M
MaxPartitions 50
MaxIconsPE 100
PCREMatchLimit 10000
PCRERecMatchLimit 5000
DetectPUA false
ScanPartialMessages false
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
PartitionIntersection false
HeuristicScanPrecedence false
StructuredDataDetection false
CommandReadTimeout 30
SendBufTimeout 200
MaxQueue 100
IdleTimeout 30
ExcludePath ^/proc/
ExcludePath ^/sys/
LocalSocket /var/run/clamav/clamd.sock
TCPSocket 3310
TCPAddr 0.0.0.0
EOF

# Copy freshclam configuration
COPY <<EOF /etc/clamav/freshclam.conf
UpdateLogFile /var/log/clamav/freshclam.log
LogVerbose false
LogSyslog false
LogFacility LOG_LOCAL6
LogFileMaxSize 0
LogRotate true
LogTime true
Foreground false
Debug false
MaxAttempts 5
DatabaseDirectory /var/lib/clamav
DNSDatabaseInfo current.cvd.clamav.net
DatabaseMirror db.local.clamav.net
DatabaseMirror database.clamav.net
PrivateMirror mirror1.example.com
PrivateMirror mirror2.example.com
Checks 24
ConnectTimeout 30
ReceiveTimeout 0
TestDatabases yes
ScriptedUpdates yes
CompressLocalDatabase no
Bytecode true
NotifyClamd /etc/clamav/clamd.conf
PidFile /var/run/clamav/freshclam.pid
DatabaseOwner clamav
EOF

# Create startup script
COPY <<'EOF' /app/start.sh
#!/bin/sh
set -e

echo "Starting SEO Image Renamer Worker Service..."

# Start ClamAV daemon if virus scanning is enabled
if [ "$VIRUS_SCAN_ENABLED" = "true" ]; then
    echo "Starting ClamAV daemon..."
    
    # Create socket directory
    mkdir -p /var/run/clamav
    chown clamav:clamav /var/run/clamav
    
    # Update virus definitions
    echo "Updating virus definitions..."
    freshclam --quiet || echo "Warning: Could not update virus definitions"
    
    # Start ClamAV daemon
    clamd &
    
    # Wait for ClamAV to be ready
    echo "Waiting for ClamAV to be ready..."
    for i in $(seq 1 30); do
        if clamdscan --version > /dev/null 2>&1; then
            echo "ClamAV is ready"
            break
        fi
        sleep 1
    done
fi

# Start the worker service
echo "Starting worker service..."
exec node dist/main.js
EOF

RUN chmod +x /app/start.sh

# Switch to non-root user
USER worker

# Expose health check port
EXPOSE 3002
EXPOSE 8080

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1

# Set environment variables
ENV NODE_ENV=production
ENV WORKER_PORT=3002
ENV HEALTH_CHECK_PORT=8080
ENV TEMP_DIR=/tmp/seo-worker

# Start the application
CMD ["/app/start.sh"]

# Labels for metadata
LABEL maintainer="SEO Image Renamer Team" \
      description="AI-powered image processing worker service" \
      version="1.0.0" \
      service="worker"