FROM node:20-bookworm-slim

# python3/make/g++ let npm fall back to compiling better-sqlite3/argon2 from
# source if no prebuilt binary matches this platform. ldap-utils provides
# the `ldapsearch` binary used for the LDAP directory browse — ldapjs's own
# BER decoder proved unreliable against real AD responses for that query.
RUN apt-get update && apt-get install -y --no-install-recommends \
    python3 make g++ ca-certificates ldap-utils \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY package.json package-lock.json ./
RUN npm ci

COPY . .
# `next build`'s page-data collection spins up several parallel workers that
# each import the db client at module-eval time. If data/db.sqlite doesn't
# exist yet, every worker races to create it from scratch — that race is at
# the file-creation level, before our code ever gets to run a busy_timeout
# pragma, so it can throw SQLITE_BUSY (or worse) independent of pragma order.
# Migrating first — as its own isolated, single-process step — means the
# workers only ever see an already-existing, already-stable file.
RUN mkdir -p data && npm run db:migrate
RUN npm run build

ENV NODE_ENV=production
EXPOSE 8081

# Migrate the (volume-mounted) SQLite DB and bootstrap the admin account on
# every start — both are no-ops once already applied.
CMD ["sh", "-c", "npm run db:migrate && npm run bootstrap-admin && npm start"]