# Dojo Bay, packaged as an Archipelago app.
#
# Node 24 is required: the backend runs .ts directly via Node's type-stripping,
# and its BIP47 libraries need it too (see the upstream project's README).
# nginx serves the static directory site and proxies /api/ to the Node
# backend in the same container — see nginx.conf for why both live here
# instead of relying on a systemd pair the way the standalone deploy did.
#
# Runs fully rootless: no `user` directive in nginx.conf, so nginx's master
# and worker processes just inherit whatever UID started them (dojobay,
# below) — no privilege to drop, none ever held.
FROM node:24-alpine AS deps
WORKDIR /app/server
COPY server/package.json server/package-lock.json ./
RUN npm ci --omit=dev

FROM node:24-alpine
RUN apk add --no-cache nginx tini \
  && addgroup -S dojobay && adduser -S dojobay -G dojobay

WORKDIR /app
COPY --from=deps /app/server/node_modules /app/server/node_modules
COPY server/ /app/server/
COPY scripts/ /app/scripts/
COPY assets/ /app/assets/
COPY content/ /app/content/
COPY types.d.ts /app/types.d.ts
COPY index.html favicon.svg manifest.json sw.js /app/
COPY data-template/ /app/data-template/
COPY nginx.conf /etc/nginx/nginx.conf
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh \
  && mkdir -p /app/data /app/server/data \
  && chown -R dojobay:dojobay /app \
  && chown -R dojobay:dojobay /var/lib/nginx /var/log/nginx /run

USER dojobay:dojobay
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD wget -q -O- http://127.0.0.1:8080/ >/dev/null || exit 1

# tini reaps the two children (node + nginx) and forwards signals cleanly.
ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"]