# syntax=docker/dockerfile:1

# ---- build ----------------------------------------------------------------
# Pinned to the same Node major the project declares in package.json engines.
FROM node:24-alpine AS build
WORKDIR /app

# npm ci against the lockfile alone, so this layer caches across source edits.
COPY package.json package-lock.json ./
RUN npm ci

COPY . .
RUN npm run build:prod

# ---- runtime --------------------------------------------------------------
# Unprivileged nginx: listens on 8080 and runs as a non-root user out of the box.
FROM nginxinc/nginx-unprivileged:alpine AS runtime

COPY --chown=nginx:nginx nginx.conf /etc/nginx/conf.d/default.conf
COPY --chown=nginx:nginx security-headers.conf /etc/nginx/snippets/security-headers.conf
COPY --from=build --chown=nginx:nginx /app/dist/ludos-web/browser /usr/share/nginx/html

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD ["wget", "-q", "--spider", "http://127.0.0.1:8080/"]