FROM node:20-alpine

WORKDIR /app

RUN apk add --no-cache curl tini

# Copy everything
COPY . .

# Install all deps
RUN npm ci

# Build the app (creates dist/public/ for static serving)
RUN npm run build

# Create non-root user for security
RUN addgroup -S appgroup && adduser -S appuser -G appgroup && chown -R appuser:appgroup /app

USER appuser

ENV NODE_ENV=production
ENV PORT=3000

EXPOSE 3000

ENTRYPOINT ["tini", "--"]

HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:3000/api/orats/status || exit 1

# Run with tsx so the built server + dist/public/ are available
CMD ["npx", "tsx", "server/index.ts"]