FROM node:24-slim AS frontend-build
WORKDIR /app

# Required: build-time injection for frontend
ARG VITE_BACKEND_URL
ENV VITE_BACKEND_URL=${VITE_BACKEND_URL}

COPY hls-player/package*.json hls-player/
RUN cd hls-player && npm ci

COPY hls-player hls-player
RUN cd hls-player && npm run build

FROM node:24-slim AS backend-runtime
WORKDIR /app
ENV NODE_ENV=production

COPY backend/package*.json backend/
RUN cd backend && npm ci --omit=dev

COPY backend backend
COPY --from=frontend-build /app/hls-player/dist hls-player/dist

# State directories owned by the unprivileged runtime user. A new named volume
# inherits this ownership; an existing root-owned volume needs a one-time chown.
RUN mkdir -p backend/data backend/uploads && chown -R node:node backend/data backend/uploads
USER node

EXPOSE 2738
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
  CMD ["node", "-e", "fetch(`http://${require('node:os').hostname()}:${process.env.BACKEND_PORT || 2738}/health`).then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"]

CMD ["node", "backend/index.js"]
