FROM node:22-bookworm-slim

WORKDIR /app
ENV NODE_ENV=production

COPY package.json package-lock.json ./
RUN npm ci --omit=dev

COPY public ./public
COPY server ./server
COPY shared ./shared
COPY db/migrations ./db/migrations
COPY scripts ./scripts
RUN node scripts/stamp-asset-version.mjs
COPY docker-entrypoint.sh /usr/local/bin/roast-command-center-entrypoint
RUN chmod 755 /usr/local/bin/roast-command-center-entrypoint

# The optional Pi agent configuration is mounted read-only at /run and copied to this writable
# runtime directory by the entrypoint; Pi's auth storage needs a sibling lock file.
ENV HOME=/home/node
RUN mkdir -p /home/node/.pi/agent && chown -R node:node /home/node/.pi
USER node
EXPOSE 8090
ENTRYPOINT ["roast-command-center-entrypoint"]
CMD ["node", "server/index.js"]