FROM node:20-alpine

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

COPY prisma ./prisma
RUN npx prisma generate

COPY . .
RUN adduser -D -g '' nodeuser && chown -R nodeuser:nodeuser /app
USER nodeuser

EXPOSE 3000
CMD ["sh", "-c", "node ./scripts/ensure-keys.js && npx prisma migrate deploy && node server.js"]