FROM node:22-slim AS frontend-build
WORKDIR /frontend
COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci
COPY frontend/ ./
RUN npm run build

FROM python:3.13-slim AS backend
WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

COPY backend/requirements.txt ./backend/requirements.txt
RUN pip install --no-cache-dir -r backend/requirements.txt

COPY backend/ ./backend/
COPY migrations/ ./migrations/
COPY alembic.ini ./alembic.ini
COPY --from=frontend-build /frontend/dist ./backend/static

ENV PYTHONPATH=/app/backend
WORKDIR /app

COPY entrypoint.sh ./entrypoint.sh
RUN chmod +x ./entrypoint.sh

# Run as an unprivileged user: the app only reads the baked-in code/static
# assets and talks to Postgres/MeTube over the network, it never needs root.
RUN useradd --uid 10001 app
USER app

EXPOSE 8080

ENTRYPOINT ["./entrypoint.sh"]