# Build context: a reviewed public release directory, never the repository root.
# Keep this file next to Dockerfile.dockerignore when selecting it with -f.
FROM --platform=linux/amd64 node:24.21.0-bookworm-slim@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20

# Native Go TLS uses the OS roots. Node's bundled roots do not replace them.
RUN apt-get update \
    && apt-get install -y --no-install-recommends --no-upgrade ca-certificates=20250419~deb12u1 \
    && rm -rf /var/lib/apt/lists/* \
    && update-ca-certificates \
    && test -s /etc/ssl/certs/ca-certificates.crt \
    && test -s /usr/share/zoneinfo/Asia/Shanghai \
    && test -s /usr/share/zoneinfo/UTC

RUN groupadd --gid 10001 aiput \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin aiput \
    && install -d -o 10001 -g 10001 -m 0700 /var/lib/aiput /run/aiput \
    && install -d -m 0755 /app /etc/aiput

WORKDIR /app
COPY --chown=10001:10001 bin/new-api /app/bin/new-api
COPY --chown=10001:10001 identity/src /app/identity/src
COPY --chown=10001:10001 identity/public /app/identity/public
COPY --chown=10001:10001 identity/package.json /app/identity/package.json
COPY --chown=10001:10001 web/dist /app/web/dist
COPY --chown=10001:10001 web/aiput-build-manifest.json /app/web/aiput-build-manifest.json
COPY --chown=10001:10001 config/default.json /app/config/default.json
COPY --chown=10001:10001 deploy/readiness-check.mjs /app/deploy/readiness-check.mjs
COPY --chown=10001:10001 licenses /app/licenses
RUN chmod 0555 /app/bin/new-api

ENV NODE_ENV=production TZ=Asia/Shanghai
USER 10001:10001
EXPOSE 3000
STOPSIGNAL SIGTERM
CMD ["node", "/app/identity/src/start.mjs", "--config", "/etc/aiput/runtime.json"]
