# Source and base images are immutable; build only in disposable, secret-free isolation.
FROM docker.io/library/node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS build
RUN apk add --no-cache git python3
WORKDIR /src
RUN git init . && git remote add origin https://github.com/forgesworn/kithmoot.git && \
    git fetch --depth 1 origin 408c7b8e00caa3c968926fa7c3c9cd4ac58c76b9 && \
    git checkout --detach FETCH_HEAD && \
    test "$(git rev-parse HEAD)" = 408c7b8e00caa3c968926fa7c3c9cd4ac58c76b9
RUN npm ci --no-audit --no-fund
COPY integrate.py /tmp/integrate.py
COPY archipelago-video.mjs video-entry.mjs /src/app/public/
RUN python3 /tmp/integrate.py && npm run build

FROM docker.io/library/nginx:1.31.4-alpine@sha256:1f25fedd50aec27413031afb3a4f8ee4effcc9d843f6a76e81bfa92245ac5c06
LABEL org.opencontainers.image.title="KithMoot for Archipelago" \
      org.opencontainers.image.source="https://github.com/forgesworn/kithmoot" \
      org.opencontainers.image.revision="408c7b8e00caa3c968926fa7c3c9cd4ac58c76b9" \
      org.opencontainers.image.licenses="MIT"
COPY --from=build /src/app/dist/ /usr/share/nginx/html/j/
COPY --from=build /src/LICENSE /usr/share/licenses/kithmoot/LICENSE
COPY nginx.conf /etc/nginx/nginx.conf
# The provider is deliberately outside the PWA scope and its precache.
# The host hook copies the canonical provider into the persistent bridge mount.
RUN mkdir -p /bridge && chmod 755 /bridge
USER 101:101
EXPOSE 8080
ENTRYPOINT ["nginx"]
CMD ["-g", "daemon off;"]
HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1