FROM node:22-bookworm-slim AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY tsconfig.server.json tsconfig.web.json vite.config.ts vitest.config.ts eslint.config.js ./
COPY src ./src
COPY web ./web
RUN npm run build && npm prune --omit=dev

FROM node:22-bookworm-slim
ENV NODE_ENV=production DATA_DIR=/data BACKUP_DIR=/backups PORT=3000
WORKDIR /app
RUN groupadd --gid 10001 backup-manager && useradd --uid 10001 --gid backup-manager --no-create-home backup-manager \
  && mkdir /data /backups && chown backup-manager:backup-manager /data /backups
COPY --from=build --chown=backup-manager:backup-manager /app/package.json /app/package-lock.json ./
COPY --from=build --chown=backup-manager:backup-manager /app/node_modules ./node_modules
COPY --from=build --chown=backup-manager:backup-manager /app/dist ./dist
USER backup-manager
EXPOSE 3000
CMD ["node", "dist/server/server.js"]