# Prometheus service image.
#
# Built for the standalone docker-compose at deploy/docker-compose.yml, which
# attaches to the hephaestus_default network so Hephaestus's Caddy can route
# prometheus.x → prometheus:3700 without either side knowing about the other.
#
# node:22-alpine keeps the image small (~55 MB with deps) and gives us
# node:sqlite (stable in 22+). We copy package files first so a code change
# that leaves deps alone reuses the npm layer.

FROM node:22-alpine

RUN apk add --no-cache tini

WORKDIR /opt/prometheus

COPY package.json package-lock.json ./
RUN npm ci --omit=dev

COPY service/   ./service/
COPY public/    ./public/
COPY scripts/   ./scripts/

# /data holds everything that must survive a container rebuild: the SQLite
# DB, the service's own ed25519 key, uploaded binaries and (for the snapshot
# timer) the rendered static mirror.
ENV PROMETHEUS_DB=/data/db.sqlite \
    PROMETHEUS_KEY_DIR=/data/keys \
    PROMETHEUS_UPLOAD_DIR=/data/uploads \
    BIND=0.0.0.0 \
    PORT=3700
RUN mkdir -p /data/keys /data/uploads && chown -R node:node /data /opt/prometheus
USER node

EXPOSE 3700

ENTRYPOINT ["/sbin/tini", "--"]
CMD ["node", "service/server.js"]