FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
# Chromium sert au pré-rendu des pages publiques (scripts/prerender.mjs) — build only.
RUN apk add --no-cache chromium nss freetype harfbuzz ca-certificates ttf-freefont
ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293
RUN addgroup -S app && adduser -S app -G app
COPY --from=builder --chown=app:app /app/dist /srv
COPY --from=builder --chown=app:app /app/scripts/static-server.mjs /app/static-server.mjs
COPY --from=builder --chown=app:app /app/locales.json /app/locales.json
USER app
EXPOSE 3001
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD node -e "fetch('http://127.0.0.1:3001/').then(r => { if (!r.ok) process.exit(1) }).catch(() => process.exit(1))"
CMD ["node", "/app/static-server.mjs", "/srv", "3001"]
