FROM node:20-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
    libssl3 \
    zlib1g \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY package.json package-lock.json ./
RUN npm ci --ignore-scripts
COPY prisma ./prisma/
RUN npx prisma generate

COPY . .

ENV NODE_ENV=production

# /app/storage holds the IPA files and tweak icons and is shared with the app.
# NOTE: a bind mount there shadows this directory, so the host path must already
# be owned by uid/gid 1001 — the build-time chown does not reach it.
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nextjs && \
    mkdir -p /app/tdlib-data/db /app/tdlib-data/files \
             /app/storage/ipa /app/storage/icons /app/storage/tmp \
             /tmp/ftstore && \
    chown -R nextjs:nodejs /app /tmp/ftstore

USER nextjs

# Same two steps the app boots with, in the same order: `pre-push.sql` applies
# what `db push` refuses to do to a database that already has rows, then the
# push. Whichever container gets there first does the work; the script takes an
# advisory lock so the other one waits rather than racing it.
CMD ["sh", "-c", "npx prisma db execute --schema prisma/schema.prisma --file prisma/pre-push.sql && npx prisma db push --skip-generate && npx tsx worker/index.ts"]