FROM oven/bun:1-alpine

WORKDIR /app

# Install deps as root
COPY package.json bun.lock* ./
RUN bun install --frozen-lockfile 2>/dev/null || bun install

COPY tsconfig.json ./
COPY src/ ./src/

# Create data dir and non-root user
RUN mkdir -p /data && \
    addgroup -g 1001 rsocials && \
    adduser -u 1001 -G rsocials -s /bin/sh -D rsocials && \
    chown -R rsocials:rsocials /app /data

USER rsocials

ENV PORT=3001
ENV DATABASE_PATH=/data/instances.db
ENV NODE_ENV=production

EXPOSE 3001

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD wget -qO- http://localhost:3001/health || exit 1

CMD ["bun", "run", "src/index.ts"]