# The WristCode gateway. The gateway has no runtime dependencies, so the image is the Bun base plus
# src/. State lives in /data (one SQLite file), which compose mounts from the host.
# Builds the same under docker and podman: `docker build -f gateway/Containerfile gateway`.

# Pinned by digest. Bump the tag and digest together.
FROM docker.io/oven/bun:1.4.0-alpine@sha256:07235578f79ef8c6f97d94aee7938e76f5cdba5f21ae5dbfdd3d3d38058437eb

WORKDIR /app
COPY package.json tsconfig.json ./
COPY src ./src

# `wristcode <command>` for operators: podman exec -it wristcode-gateway wristcode pair
RUN printf '#!/bin/sh\nexec bun /app/src/cli.ts "$@"\n' > /usr/local/bin/wristcode \
    && chmod +x /usr/local/bin/wristcode \
    && mkdir -p /data && chown bun:bun /data

ENV NODE_ENV=production \
    PORT=8080 \
    WRISTCODE_DB=/data/wristcode.sqlite

USER bun
EXPOSE 8080
VOLUME /data
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD wget -q -O /dev/null http://127.0.0.1:8080/v1/health || exit 1
CMD ["bun", "src/main.ts"]