FROM node:24-alpine

WORKDIR /app
ENV NODE_ENV=production

# install dependencies first so code-only changes reuse this layer
COPY package.json package-lock.json ./
RUN npm ci --omit=dev && npm cache clean --force

COPY src ./src

# sessions live in each user's browser; the only state is saved settings and name
# suggestions in /app/data, which compose mounts as a volume. Made here so node owns it.
RUN mkdir -p /app/data && chown node:node /app/data
ENV DATA_DIR=/app/data
USER node
EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD wget -qO- http://127.0.0.1:3000/healthz || exit 1

CMD ["node", "src/server.js"]