# DTD SourceDesk 0.3.0 container image. Data lives only in the /data volume on your Docker host.
#   docker build -t dtd-sourcedesk:0.3.0 .      (or: docker compose up -d)
# Updates: build/pull the next image and recreate the container; in-app automatic updates are off in Docker.
FROM node:22.23.4-slim
ENV NODE_ENV=production \
    DTD_DATA_DIR=/data \
    PORT=8101 \
    HOST=0.0.0.0 \
    SIGNUP_MODE=invite
WORKDIR /opt/dtd-sourcedesk
# Program files are owned by root and read-only for the service user.
COPY app/ ./
RUN groupadd --system dtd \
 && useradd --system --gid dtd --home-dir /data --no-create-home --shell /usr/sbin/nologin dtd \
 && mkdir -p /data \
 && chown dtd:dtd /data \
 && chmod 750 /data
USER dtd
VOLUME ["/data"]
EXPOSE 8101
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||8101)+'/api/health').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
CMD ["node", "server.mjs"]
