Dockerfile.handbook

# syntax=docker/dockerfile:1
#
# Static nginx host for docs/handbook/ — served at handbook.realunit.app (PRD)
# and dev-handbook.realunit.app (DEV) via Cloudflare Tunnel.
#
# Built independently of the Flutter app: no Flutter toolchain, no app code.
# Build context is the repo root; only docs/handbook/, scripts/, and
# test/goldens/ are copied in.
#
# The 52 screenshots (`screenshots/NN-name.png`) are assembled from the
# visual-regression Golden baselines under `test/goldens/screens/` via
# scripts/assemble-handbook-screenshots.sh — one Golden per handbook
# entry, see the mapping in that script. `docs/handbook/screenshots/` is
# git-ignored (the directory holds the assembly output for local previews
# only); the second COPY below populates it inside the image from the
# multi-stage assembly result.
#
# Note: docs/handbook/mails/ is git-ignored and populated at CI build time
# by the "Generate RealUnit mail previews from api repo" step in
# .github/workflows/handbook.yaml — DFXswiss/api is the single source of
# truth for those previews. The first COPY picks them up automatically as
# part of the docs/handbook/ tree.

FROM alpine:3.20 AS screenshots-builder
WORKDIR /work
RUN apk add --no-cache bash coreutils
COPY scripts/assemble-handbook-screenshots.sh ./scripts/
COPY test/goldens/screens/ ./test/goldens/screens/
RUN bash ./scripts/assemble-handbook-screenshots.sh /out

# Store-listing section: derived export of the Fastlane metadata
# (ios/fastlane/metadata + android/fastlane/metadata + screenshots). The
# generator copies the PNGs to /out/{ios,android}/... and rewrites the
# <!-- BEGIN/END:store-listing --> block in docs/handbook/de/index.html in
# place. Single source of truth is the Fastlane metadata; this handbook
# section just renders it (same upstream/downstream model as mails/).
#
# Note: this stage always renders from the metadata and serves its own
# rewritten index.html, so the IMAGE is self-consistent even if the
# committed docs/handbook/de/index.html were stale. Keeping the committed
# handbook in sync with the metadata is enforced separately by the sync
# gate in handbook-build-check.yaml (the generator is pure-stdlib and
# version-stable, so the runner's python3 and this Alpine python3 produce
# identical output).
FROM alpine:3.20 AS store-listing-builder
WORKDIR /work
RUN apk add --no-cache python3
COPY scripts/assemble-handbook-store-listing.py ./scripts/
COPY scripts/templates/store-listing.html.tmpl ./scripts/templates/
COPY ios/fastlane/metadata/ ./ios/fastlane/metadata/
COPY ios/fastlane/screenshots/ ./ios/fastlane/screenshots/
COPY android/fastlane/metadata/ ./android/fastlane/metadata/
COPY docs/handbook/de/index.html ./docs/handbook/de/index.html
RUN python3 ./scripts/assemble-handbook-store-listing.py /out && cp ./docs/handbook/de/index.html /out/index.html

# Legal-downloads section: derived export of the in-app legal Markdown
# (assets/legal/*.md). Two separate concerns, by design:
#   - assemble-handbook-legal.py rewrites the deterministic <!-- BEGIN/END:
#     legal-downloads --> block in index.html (committed + sync-gated upstream).
#   - build-legal-downloads.sh renders the NON-deterministic PDF/DOCX via pandoc
#     (weasyprint PDF engine — no TeX), git-ignored like the screenshots.
# This stage takes the store-listing-rewritten index.html as input so BOTH the
# store-listing and the legal-downloads blocks survive into the final image.
FROM alpine:3.20 AS legal-docs-builder
WORKDIR /work
# font-dejavu (+ a rebuilt fontconfig cache) is required: weasyprint renders via
# Pango, which aborts ("No fonts configured in FontConfig" → "Error producing
# PDF") on a bare Alpine that ships no font files. DejaVu covers the Latin/German
# glyphs the legal texts use.
RUN apk add --no-cache python3 pandoc weasyprint bash font-dejavu \
 && fc-cache -f
COPY scripts/assemble-handbook-legal.py ./scripts/
COPY scripts/build-legal-downloads.sh ./scripts/
COPY scripts/templates/legal-downloads.html.tmpl ./scripts/templates/
COPY assets/legal/ ./assets/legal/
COPY assets/languages/ ./assets/languages/
COPY --from=store-listing-builder /out/index.html ./docs/handbook/de/index.html
RUN python3 ./scripts/assemble-handbook-legal.py /out \
 && bash ./scripts/build-legal-downloads.sh /out \
 && cp ./docs/handbook/de/index.html /out/index.html

FROM nginx:1.27.5-alpine

COPY docs/handbook/ /usr/share/nginx/html/
COPY --from=screenshots-builder /out/ /usr/share/nginx/html/screenshots/
# Store-listing PNGs + the substituted index.html (overwrites the verbatim
# docs/handbook copy above with the generated export).
COPY --from=store-listing-builder /out/ios/ /usr/share/nginx/html/store/ios/
COPY --from=store-listing-builder /out/android/ /usr/share/nginx/html/store/android/
COPY --from=store-listing-builder /out/index.html /usr/share/nginx/html/de/index.html
# Legal-downloads PDFs/DOCX + the index.html with BOTH the store-listing and the
# legal-downloads blocks rewritten (this copy overwrites the store-listing one
# above, so the legal stage's index.html is the authoritative final version).
COPY --from=legal-docs-builder /out/legal/ /usr/share/nginx/html/legal/
COPY --from=legal-docs-builder /out/index.html /usr/share/nginx/html/de/index.html
COPY handbook.nginx.conf /etc/nginx/conf.d/default.conf
COPY handbook.htpasswd /etc/nginx/handbook.htpasswd

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
    CMD wget -qO- --timeout=3 http://127.0.0.1:8080/healthz >/dev/null || exit 1