# syntax=docker/dockerfile:1

# ---------------------------------------------------------------------------
# Dependencies (sharp ships prebuilt linux-x64/arm64 binaries, so no build
# toolchain is needed on glibc images).
# ---------------------------------------------------------------------------
FROM node:22-bookworm-slim AS deps

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev


# ---------------------------------------------------------------------------
# Runtime
# ---------------------------------------------------------------------------
FROM node:22-bookworm-slim

ENV NODE_ENV=production \
    SINKER_SOURCE_DIR=/books/in \
    SINKER_OUTPUT_DIR=/books/out \
    SINKER_STATE_DIR=/data/state \
    SINKER_OAUTH_DIR=/data/oauth \
    SINKER_LOGIN_HOST=0.0.0.0

WORKDIR /app

COPY --from=deps /app/node_modules ./node_modules
COPY package.json ./
COPY src ./src

RUN groupadd --system sinker \
 && useradd --system --gid sinker --home-dir /data --shell /usr/sbin/nologin sinker \
 && mkdir -p /data/state /data/oauth /books/in /books/out \
 && chown -R sinker:sinker /data /books /app

USER sinker

VOLUME ["/data", "/books/in", "/books/out"]

ENTRYPOINT ["node", "src/sinker-cli.js"]
CMD ["watch"]