# syntax=docker/dockerfile:1
# Build context is the repository root, so the site can read plugins/catalog.json, the
# plugin versions and the editor screenshots. Dockerfile.dockerignore keeps the context small.

FROM node:24-alpine AS build
WORKDIR /repo/website
COPY website/package.json website/package-lock.json ./
RUN npm ci --no-audit --no-fund
COPY . /repo
ARG SITE_URL=https://fl.narl.io
ENV SITE_URL=$SITE_URL
RUN npm run build

FROM nginxinc/nginx-unprivileged:stable-alpine
COPY website/docker/nginx.conf /etc/nginx/nginx.conf
COPY website/docker/security-headers.conf /etc/nginx/security-headers.conf
COPY website/docker/40-legal-notice.sh /docker-entrypoint.d/40-legal-notice.sh
COPY --from=build /repo/website/dist /usr/share/nginx/html
COPY --from=build /repo/website/dist/impressum/index.html /opt/legal-templates/impressum/index.html
COPY --from=build /repo/website/dist/datenschutz/index.html /opt/legal-templates/datenschutz/index.html

# Only the two legal pages are rewritten at start-up; everything else stays read-only.
USER root
RUN rm -f /etc/nginx/conf.d/default.conf \
    && chown 101:101 /usr/share/nginx/html/impressum/index.html /usr/share/nginx/html/datenschutz/index.html
USER 101

EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
    CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz || exit 1