# Local release candidate; deployment requires separate approval.
# Build context: a reviewed public release directory, never the repository root.
# Keep this file next to Dockerfile.dockerignore when selecting it with -f.
FROM --platform=linux/amd64 node:24.21.0-bookworm-slim@sha256:d6aa754f16b3197301076f047b5def2f02ea1dbbc2ca920407d46d7ec7f87b20

# Native Go TLS uses the OS roots. Node's bundled roots do not replace them.
# Bootstrap HTTPS with the pinned official Node image's public Mozilla trust roots.
# This does not disable certificate or Debian package-signature verification.
RUN node -e 'require("fs").writeFileSync("/tmp/apt-bootstrap-ca.pem", require("tls").rootCertificates.join("\n"))' \
    && sed -i 's@http://deb.debian.org@https://deb.debian.org@g' /etc/apt/sources.list.d/debian.sources \
    && apt-get -o Acquire::https::CaInfo=/tmp/apt-bootstrap-ca.pem -o Acquire::Retries=2 -o Acquire::https::Timeout=30 update \
    && apt-get -o Acquire::https::CaInfo=/tmp/apt-bootstrap-ca.pem -o Acquire::Retries=2 -o Acquire::https::Timeout=30 install -y --no-install-recommends --no-upgrade ca-certificates=20250419~deb12u1 ffmpeg=7:5.1.9-0+deb12u1 perl=5.36.0-7+deb12u4 \
    && rm -rf /var/lib/apt/lists/* /tmp/apt-bootstrap-ca.pem \
    && update-ca-certificates \
    && test -s /etc/ssl/certs/ca-certificates.crt \
    && test -s /usr/share/zoneinfo/Asia/Shanghai \
    && test -s /usr/share/zoneinfo/UTC

RUN groupadd --gid 10001 aiput \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin aiput \
    && install -d -o 10001 -g 10001 -m 0700 /var/lib/aiput /run/aiput \
    && install -d -m 0755 /app /etc/aiput

WORKDIR /app
COPY --chown=10001:10001 bin/new-api /app/bin/new-api
COPY --chown=10001:10001 identity/src /app/identity/src
COPY --chown=10001:10001 identity/public /app/identity/public
COPY --chown=10001:10001 identity/package.json /app/identity/package.json
COPY --chown=10001:10001 web/dist /app/web/dist
COPY --chown=10001:10001 web/aiput-build-manifest.json /app/web/aiput-build-manifest.json
COPY --chown=10001:10001 config/default.json /app/config/default.json
COPY --chown=10001:10001 deploy/readiness-check.mjs /app/deploy/readiness-check.mjs
COPY --chown=10001:10001 licenses /app/licenses
COPY --chown=10001:10001 media/tools/exiftool /app/media/tools/exiftool
COPY --chown=10001:10001 media/exiftool.config /app/media/exiftool.config
RUN chmod 0555 /app/bin/new-api

ENV NODE_ENV=production TZ=Asia/Shanghai
USER 10001:10001
EXPOSE 3000
STOPSIGNAL SIGTERM
CMD ["node", "/app/identity/src/start.mjs", "--config", "/etc/aiput/runtime.json"]
