# syntax=docker/dockerfile:1
FROM node:20-alpine AS base

# Stage 1: Dependencies
FROM base AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && \
    # Clean up to keep image small
    npm cache clean --force

# Stage 2: Production runtime
FROM base AS runner
WORKDIR /app

# Create non-root user for security
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 --ingroup nodejs expressuser

# Copy production dependencies
COPY --from=deps /app/node_modules ./node_modules
COPY --from=deps /app/package.json ./

# Copy application code
COPY src/ ./src/
COPY tokens/ ./tokens/

# Create data directory for SQLite and set permissions
RUN mkdir -p /app/data && \
    chown -R expressuser:nodejs /app

USER expressuser

# Expose port
EXPOSE 1867

# Healthcheck
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
  CMD node -e "require('http').get('http://localhost:1867/health', (res) => process.exit(res.statusCode === 200 ? 0 : 1))" || exit 1

ENV NODE_ENV=production
CMD ["node", "src/server.js"]