# The app runs TypeScript directly on Node 24, so there is no build step and no
# compiler in the image. Node 24 on Alpine is musl, which sharp ships prebuilt
# binaries for.
FROM node:24-alpine

ENV NODE_ENV=production
WORKDIR /app

# Dependencies first, so editing source does not reinstall them.
COPY --chown=node:node package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force

COPY --chown=node:node src ./src
COPY --chown=node:node public ./public
COPY --chown=node:node config ./config
COPY --chown=node:node scripts ./scripts

# Config is mounted read-only; everything the app writes lives under MENU_ROOT.
ENV MENU_ROOT=/data
ENV MENU_SITE_CONFIG=/etc/menu-app/site.json
ENV PORT=3000

RUN mkdir -p /data && chown node:node /data
USER node

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

CMD ["node", "src/server.ts"]