# Agent Authority, customer mode, in one container: the API and the web app behind scripts/start.ts.
# Put Caddy (deploy/Caddyfile) or any TLS-terminating proxy in front; both processes bind loopback
# inside the container and are published on 4640 (web) only. State lives in /data: the private
# configuration written by `npm run setup`, the SQLite database, browser profiles.
#
# Not executed on the machine this was written on (no container runtime there). Build and run it
# once on the target host before trusting it: docs/DEPLOY.md, step 4.
FROM node:22-bookworm-slim AS build
WORKDIR /app
COPY package.json package-lock.json ./
COPY packages ./packages
COPY apps ./apps
COPY scripts ./scripts
COPY tsconfig.base.json tsconfig.json vitest.config.ts ./
RUN npm ci --no-audit --no-fund \
 && npm run build

FROM node:22-bookworm-slim
ENV NODE_ENV=production \
    AUTHORITY_CONFIG_FILE=/data/server.env \
    WEB_BIND_HOST=0.0.0.0
WORKDIR /app
COPY --from=build /app /app
# The daemon user owns /data; nothing else in the image is writable by it.
RUN groupadd -r authority && useradd -r -g authority -d /data -s /usr/sbin/nologin authority \
 && mkdir -p /data && chown authority:authority /data && chmod 700 /data
USER authority
VOLUME ["/data"]
EXPOSE 4640
# First run: `docker compose run --rm app npm run setup` writes /data/server.env and the one-time setup code.
CMD ["node", "--import", "tsx", "scripts/start.ts"]
