FROM node:20-alpine AS frontend-build
WORKDIR /app/frontend
COPY frontend/package*.json ./
RUN npm install
COPY frontend/ ./
RUN npm run build

FROM node:20-alpine
RUN apk add --no-cache python3 make g++ openssl wget su-exec

# Create non-root user (Punkt 6: Non-Root Container)
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app
COPY backend/package*.json ./
RUN npm install
COPY backend/ ./
COPY --from=frontend-build /app/frontend/dist ./frontend/dist

# Create data directory
RUN mkdir -p /app/data/uploads

EXPOSE 5000

# Health check (Punkt 7: Docker Healthcheck)
HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=10s \
  CMD wget -qO- http://localhost:5000/health || exit 1

# Entrypoint: fix permissions on mounted volumes, then run as non-root user
ENTRYPOINT ["sh", "-c", "chown -R appuser:appgroup /app/data 2>/dev/null; exec su-exec appuser node server.js"]