# Unified Chat
# Self-contained image: Node + app deps baked in, nothing installed at runtime.
FROM node:20-alpine

# tini    -> proper PID 1 signal handling, so `docker stop` is instant
# su-exec -> drop privileges in the entrypoint after fixing volume ownership
# (HEALTHCHECK uses busybox's built-in wget, already present)
RUN apk add --no-cache tini su-exec

WORKDIR /usr/src/app

# Install deps first for better layer caching
COPY package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force

# App source
COPY unified-chat.js ./
COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh && mkdir -p /usr/src/app/tokens

ENV PORT=8088 \
    NODE_ENV=production \
    PUID=1000 \
    PGID=1000

EXPOSE 8088

# YouTube OAuth tokens are written to <cwd>/tokens/youtube.json.
# Mount a host directory here so the connection survives image updates.
VOLUME ["/usr/src/app/tokens"]

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget -qO- "http://127.0.0.1:${PORT}/healthz" >/dev/null 2>&1 || exit 1

ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
CMD ["node", "unified-chat.js"]