topiam/eiam-console/Dockerfile

# =============================================
# TOPIAM Console - 多阶段构建（简化 Maven 配置）
# =============================================

# ---- 阶段 1: 前端构建 ----
FROM m.daocloud.io/docker.io/library/node:22.12.0-alpine AS frontend-builder

WORKDIR /build/console-fe

# 配置 pnpm 和镜像源
RUN npm config set registry https://registry.npmmirror.com && \
    npm install -g pnpm@9.15.1

# 先复制 package.json 利用缓存
COPY eiam-console/src/main/console-fe/package.json eiam-console/src/main/console-fe/pnpm-lock.yaml* ./
RUN pnpm install --frozen-lockfile --ignore-scripts

# 复制源码并构建
COPY eiam-console/src/main/console-fe/ ./
ENV UMI_ENV=dev
RUN npm run build:dev


# ---- 阶段 2: 后端构建 ----
FROM m.daocloud.io/docker.io/library/maven:3.9-eclipse-temurin-17 AS backend-builder

WORKDIR /build

# 设置 Maven 参数（避免配置文件冲突）
ENV MAVEN_OPTS="-Xmx2048m -Xms1024m -Djava.awt.headless=true -Dmaven.multiModuleProjectDirectory=/build"

# 复制父 pom 和所有模块 pom（父 pom 需要所有子模块存在）
COPY pom.xml .
COPY eiam-common/pom.xml eiam-common/pom.xml
COPY eiam-core/pom.xml eiam-core/pom.xml
COPY eiam-audit/pom.xml eiam-audit/pom.xml
COPY eiam-application/pom.xml eiam-application/pom.xml
COPY eiam-application/eiam-application-core/pom.xml eiam-application/eiam-application-core/pom.xml
COPY eiam-application/eiam-application-oidc/pom.xml eiam-application/eiam-application-oidc/pom.xml
COPY eiam-application/eiam-application-jwt/pom.xml eiam-application/eiam-application-jwt/pom.xml
COPY eiam-application/eiam-application-form/pom.xml eiam-application/eiam-application-form/pom.xml
COPY eiam-application/eiam-application-all/pom.xml eiam-application/eiam-application-all/pom.xml
COPY eiam-protocol/pom.xml eiam-protocol/pom.xml
COPY eiam-protocol/eiam-protocol-core/pom.xml eiam-protocol/eiam-protocol-core/pom.xml
COPY eiam-protocol/eiam-protocol-form/pom.xml eiam-protocol/eiam-protocol-form/pom.xml
COPY eiam-protocol/eiam-protocol-jwt/pom.xml eiam-protocol/eiam-protocol-jwt/pom.xml
COPY eiam-protocol/eiam-protocol-oidc/pom.xml eiam-protocol/eiam-protocol-oidc/pom.xml
COPY eiam-protocol/eiam-protocol-all/pom.xml eiam-protocol/eiam-protocol-all/pom.xml
COPY eiam-authentication/pom.xml eiam-authentication/pom.xml
COPY eiam-authentication/eiam-authentication-core/pom.xml eiam-authentication/eiam-authentication-core/pom.xml
COPY eiam-authentication/eiam-authentication-dingtalk/pom.xml eiam-authentication/eiam-authentication-dingtalk/pom.xml
COPY eiam-authentication/eiam-authentication-feishu/pom.xml eiam-authentication/eiam-authentication-feishu/pom.xml
COPY eiam-authentication/eiam-authentication-qq/pom.xml eiam-authentication/eiam-authentication-qq/pom.xml
COPY eiam-authentication/eiam-authentication-wechat/pom.xml eiam-authentication/eiam-authentication-wechat/pom.xml
COPY eiam-authentication/eiam-authentication-github/pom.xml eiam-authentication/eiam-authentication-github/pom.xml
COPY eiam-authentication/eiam-authentication-wechatwork/pom.xml eiam-authentication/eiam-authentication-wechatwork/pom.xml
COPY eiam-authentication/eiam-authentication-gitee/pom.xml eiam-authentication/eiam-authentication-gitee/pom.xml
COPY eiam-authentication/eiam-authentication-alipay/pom.xml eiam-authentication/eiam-authentication-alipay/pom.xml
COPY eiam-authentication/eiam-authentication-sms/pom.xml eiam-authentication/eiam-authentication-sms/pom.xml
COPY eiam-authentication/eiam-authentication-mail/pom.xml eiam-authentication/eiam-authentication-mail/pom.xml
COPY eiam-authentication/eiam-authentication-all/pom.xml eiam-authentication/eiam-authentication-all/pom.xml
COPY eiam-identity-source/pom.xml eiam-identity-source/pom.xml
COPY eiam-identity-source/eiam-identity-source-core/pom.xml eiam-identity-source/eiam-identity-source-core/pom.xml
COPY eiam-identity-source/eiam-identity-source-dingtalk/pom.xml eiam-identity-source/eiam-identity-source-dingtalk/pom.xml
COPY eiam-identity-source/eiam-identity-source-feishu/pom.xml eiam-identity-source/eiam-identity-source-feishu/pom.xml
COPY eiam-identity-source/eiam-identity-source-all/pom.xml eiam-identity-source/eiam-identity-source-all/pom.xml
COPY eiam-synchronizer/pom.xml eiam-synchronizer/pom.xml
COPY eiam-portal/pom.xml eiam-portal/pom.xml
COPY eiam-openapi/pom.xml eiam-openapi/pom.xml
COPY eiam-console/pom.xml eiam-console/pom.xml

# 下载依赖（离线模式）
RUN mvn dependency:go-offline -B -pl eiam-console -am

# 复制前端构建产物
COPY --from=frontend-builder /build/console-fe/build eiam-console/src/main/console-fe/build

# 复制后端源码并编译打包
COPY eiam-common eiam-common
COPY eiam-core eiam-core
COPY eiam-audit eiam-audit
COPY eiam-application eiam-application
COPY eiam-protocol eiam-protocol
COPY eiam-authentication eiam-authentication
COPY eiam-identity-source eiam-identity-source
COPY eiam-synchronizer eiam-synchronizer
COPY eiam-console/src eiam-console/src

RUN mvn package -pl eiam-console -am -P!dev -DskipTests -Dlicense.skip=true -Dformatter.skip=true -Dmaven.javadoc.skip=true


# ---- 阶段 3: 运行时镜像 ----
FROM eclipse-temurin:17-jre-alpine

# 安装基础工具：字体、时区、curl（健康检查用）
RUN apk add --no-cache \
    tzdata \
    fontconfig \
    curl \
    && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
    && echo "Asia/Shanghai" > /etc/timezone

# 创建非 root 用户
RUN addgroup -g 1000 -S topiam && \
    adduser -u 1000 -S -G topiam topiam

WORKDIR /app

# 复制 jar 包
COPY --from=backend-builder /build/eiam-console/target/topiam-employee-console-*.jar app.jar

# 修改文件所有者
RUN chown -R topiam:topiam /app

# 切换非 root 用户
USER topiam

# 暴露端口
EXPOSE 1898

# JVM 参数优化
ENV JAVA_OPTS="-Xms512m -Xmx1024m \
    -XX:+UseG1GC \
    -XX:MaxGCPauseMillis=200 \
    -XX:+HeapDumpOnOutOfMemoryError \
    -XX:HeapDumpPath=/app/heapdump.hprof \
    -Djava.security.egd=file:/dev/./urandom \
    -Dfile.encoding=UTF-8 \
    -Duser.timezone=Asia/Shanghai"

# 健康检查
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -f http://localhost:1898/actuator/health || exit 1

# 启动入口
ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -Dspring.profiles.active=remote -jar app.jar"]