# syntax=docker/dockerfile:1

# Image Debian slim (glibc) : @fastify/secure-session -> sodium-native embarque
# des prebuilds linux-x64 / linux-arm64 compilés pour la glibc (pas de variante
# musl), donc Alpine ne conviendrait pas.

# ---- deps : node_modules de production uniquement ----------------------------
FROM node:22-bookworm-slim AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev --no-audit --no-fund

# ---- build : compilation TypeScript ----------------------------------------------
FROM node:22-bookworm-slim AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY tsconfig.json tsconfig.build.json ./
COPY src ./src
RUN npm run build

# ---- runtime ----------------------------------------------------------------------
FROM node:22-bookworm-slim AS runtime
ENV NODE_ENV=production \
    MEDIADROP_CONFIG=/app/config.json
WORKDIR /app

COPY --from=deps  /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
COPY public ./public
COPY package.json ./

# Dossier de dépôt par défaut, inscriptible par l'utilisateur non-root `node`.
# (Pour des cibles hors de /app, monter des volumes appartenant à l'uid 1000.)
RUN mkdir -p /app/uploads && chown -R node:node /app/uploads

USER node
EXPOSE 3000

# GET /health ne demande aucune authentification.
# Adapter le port si `port` diffère de 3000 dans config.json.
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD ["node", "-e", "fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]

CMD ["node", "dist/index.js"]