# Build and stage on a trusted workstation first: pnpm image:stage ../delivery-app-web
# The context contains production artifacts only; Git credentials never enter the image.
FROM node:22.16.0-bookworm-slim AS standalone
RUN apt-get update \
  && apt-get install -y --no-install-recommends nginx-light tini \
  && rm -rf /var/lib/apt/lists/*
ENV NODE_ENV=production COOKIE_SECURE=true
WORKDIR /app
COPY --chown=node:node .image/api/ /app/
COPY .image/web/ /usr/share/nginx/html/
COPY infra/synology/nginx.conf /etc/nginx/model-delivery.conf
COPY infra/synology/nginx-standalone.conf /etc/nginx/nginx.conf
COPY infra/synology/start-standalone.mjs /app/start-standalone.mjs
USER node
EXPOSE 38080 38081
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:38080/api/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
ENTRYPOINT ["/usr/bin/tini", "--", "node", "/app/start-standalone.mjs"]