FROM node:22-alpine AS builder

WORKDIR /app

# Install build dependencies for native modules (sqlite3, better-sqlite3)
RUN apk add --no-cache python3 make g++

COPY package*.json ./
RUN npm install && npm cache clean --force

# --- Runtime image ---
FROM node:22-alpine

# Install runtime dependencies
# WireGuard needs community repo on some alpine versions
RUN apk add --no-cache --repository https://dl-cdn.alpinelinux.org/alpine/edge/community \
    wireguard-tools \
    && apk add --no-cache \
    iptables \
    iproute2 \
    openresolv \
    bash \
    curl \
    && rm -rf /var/cache/apk/*

WORKDIR /app

# Copy node_modules from builder (with native addons pre-compiled)
COPY --from=builder /app/node_modules ./node_modules
COPY package*.json ./

# Copy application source
COPY ./src ./src

# Copy startup script
COPY ./wg/start.sh /app/start.sh
RUN chmod +x /app/start.sh

# Create db directory
RUN mkdir -p /app/db

# Health check: bot responds to /health on port 3000
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -sf http://localhost:3000/health || exit 1

# start.sh runs as root (needed for wg-quick), then drops to node
CMD ["/bin/bash", "/app/start.sh"]