# Frontend image for dev and prod (single image).
# Dev specifics arrive via devcontainer.json / compose env — never via this
# file. DevDeps are included: `npm run dev` must work with zero steps.
FROM node:22-slim

# gosu drops privileges before serving (node user, uid 1000 — same as the
# vscode editor user, so the bind-mounted node_modules stays writable).
RUN apt-get update \
    && apt-get install -y --no-install-recommends gosu \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /srv/kirche-einfach/frontend
COPY package.json package-lock.json entrypoint.sh ./
RUN npm ci
COPY . ./
RUN chmod +x entrypoint.sh && chown -R node:node /srv/kirche-einfach/frontend

EXPOSE 3000

# Explicit `sh`: the repo bind-mount shadows the image at runtime, and git
# tracks entrypoint.sh as 100644 — relying on the exec bit breaks Windows
# checkouts (and fresh Linux clones). `sh script` needs read-only.
ENTRYPOINT ["sh", "./entrypoint.sh"]