FROM node:24-bookworm-slim

# git is needed for the read-only /git/status and /git/diff endpoints
RUN apt-get update \
 && apt-get install -y --no-install-recommends git ca-certificates \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY package.json package-lock.json ./
RUN npm ci

COPY tsconfig.json config.example.jsonc ./
COPY src ./src
COPY scripts ./scripts

# Non-root user. Mounted vaults are usually owned by a host uid that doesn't
# match the container user, which git refuses to touch by default — allow it
# system-wide (read-only endpoints only; braindump never commits).
RUN useradd -m braindump \
 && git config --system --add safe.directory '*' \
 && mkdir -p /data /config /vaults \
 && chown braindump /data

USER braindump
ENV BRAINDUMP_CONFIG=/config/config.jsonc \
    BRAINDUMP_DB=/data/braindump.sqlite \
    NODE_ENV=production

EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
  CMD node -e "fetch('http://localhost:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

CMD ["npx", "tsx", "src/bin/braindump-web.ts"]