FROM node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94 AS dependencies

WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates g++ make python3 \
    && rm -rf /var/lib/apt/lists/*

COPY package.json package-lock.json ./
COPY scripts ./scripts

# Keep lifecycle scripts disabled for the dependency tree, then explicitly
# build the one native runtime dependency required by OpenWiki.
RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
    && (cd node_modules/better-sqlite3 && npm run install) \
    && npm cache clean --force

FROM node:22.22.0-bookworm-slim@sha256:dd9d21971ec4395903fa6143c2b9267d048ae01ca6d3ea96f16cb30df6187d94

ENV NODE_ENV=production \
    OPENWIKI_TELEMETRY_DISABLED=1 \
    DO_NOT_TRACK=1 \
    WORKSPACE_DIR=/data/openwiki \
    PORT=8001

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates git libstdc++6 tini \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY --chown=node:node package.json package-lock.json ./
COPY --chown=node:node scripts ./scripts
COPY --from=dependencies --chown=node:node /app/node_modules ./node_modules

RUN npm run compatibility

COPY --chown=node:node server.js ./
COPY --chown=node:node lib ./lib

RUN install -d -o node -g node -m 0700 /data/openwiki

USER node

EXPOSE 8001
VOLUME ["/data/openwiki"]

HEALTHCHECK --interval=10s --timeout=5s --retries=12 \
    CMD ["node", "-e", "const h=require('http');const o={host:'127.0.0.1',port:process.env.PORT||8001,path:'/health',headers:{'X-LivingKB-OpenWiki-Token':process.env.OPENWIKI_TOKEN||''}};h.get(o,r=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"]

ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["node", "server.js"]
