# syntax=docker/dockerfile:1

# ── Stage 1: build ────────────────────────────────────────────────────────────
FROM node:22-alpine AS builder

WORKDIR /app

# .npmrc maps the @mozempk scope to the Gitea registry; the read token is supplied
# as a BuildKit secret so it never lands in an image layer.
COPY package.json package-lock.json .npmrc ./
RUN --mount=type=secret,id=gitea_npm \
    GITEA_NPM_TOKEN="$(cat /run/secrets/gitea_npm 2>/dev/null)" npm ci

COPY . .
RUN npm run build
RUN npm prune --production

# ── Stage 2: runtime ─────────────────────────────────────────────────────────
FROM node:22-alpine AS runtime

WORKDIR /app

# ffmpeg for yt-dlp muxing; yt-dlp via pip (prebuilt binary needs glibc, pip build works on musl)
RUN apk add --no-cache ffmpeg tzdata python3 py3-pip && \
    pip3 install --no-cache-dir --break-system-packages yt-dlp

COPY --from=builder --chown=node:node /app/build ./build
COPY --from=builder --chown=node:node /app/node_modules ./node_modules
COPY --from=builder --chown=node:node /app/drizzle.config.prod.ts ./drizzle.config.ts
COPY --from=builder --chown=node:node /app/src/lib/server/db ./drizzle
COPY --chown=node:node package.json .
COPY --chown=node:node scripts/migrate.cjs ./scripts/migrate.cjs
COPY --chown=node:node --chmod=0755 entrypoint.sh ./entrypoint.sh

RUN mkdir -p /app/db /app/downloads && chown -R node:node /app/db /app/downloads

USER node

EXPOSE 3000

ENV NODE_ENV=production \
    PORT=3000 \
    HOST=0.0.0.0 \
    TZ=Europe/Zurich

ENTRYPOINT ["/app/entrypoint.sh"]
