# Builds the required node packages.
FROM node:25 AS builder

WORKDIR /app

COPY src/package*.json ./

RUN npm install

# Builds the Pandoc application.
FROM pandoc/minimal:3.8 AS pandoc

FROM node:25 AS production

# Copies the output from the two building stages above.
COPY --from=pandoc --chmod=555 /usr/local/bin/pandoc /usr/local/bin/pandoc
COPY --from=pandoc --chmod=555 /usr/local/bin/pandoc /usr/local/share/

# Prepares the required folders.
RUN mkdir -p /var/lib/panblog/uploads && mkdir -p /var/cache/panblog/output && mkdir -p /var/cache/panblog/tmp && mkdir -p /var/cache/panblog/upload

WORKDIR /app

COPY src/package*.json ./

COPY src/* ./

# Sets users and permissions.
RUN groupadd --system --gid 1001 sysblog && \
    useradd --uid 1001 --gid 1001 -M -N --system sysblog && \
    chown -R sysblog:sysblog /var/lib/panblog && \
    chown -R sysblog:sysblog /var/cache/panblog

COPY --from=builder --chown=sysblog:sysblog /app /app

# De-escelates permissions for improved security.
USER sysblog

# Defines the expected outputs.
EXPOSE 6868

VOLUME /var/lib/panblog

VOLUME /var/cache/panblog

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node -e "require('http').get('http://localhost:8080', (res) => { process.exit(res.statusCode === 200 ? 0 : 1) })"

CMD ["node", "main.js"]