FROM node:20-alpine AS builder

WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine AS runner
WORKDIR /app

ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs
# 将 nextjs 加入 docker 组（Alpine: -g 而非 --gid），允许访问 docker.sock
RUN addgroup -g 988 docker 2>/dev/null; addgroup nextjs docker

COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

# docker-cli: 密码修改等写操作仍需 docker exec lldap（LLDAP 非 WAL 模式，不可并发写）
# sqlite: 直连只读查询 LLDAP/asstes/issue 数据库
# bcryptjs: OIDC callback 中 JWT 签发需要
RUN apk add --no-cache docker-cli sqlite && npm install bcryptjs

USER nextjs

EXPOSE 3000
ENV PORT=3000
ENV HOSTNAME="0.0.0.0"

CMD ["node", "server.js"]