FROM node:22-bookworm-slim

# ffmpeg-static / ffprobe-static 自带二进制，不需要系统安装 ffmpeg。
# 但 glibc 环境仍需要这几个运行库供其依赖使用。
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates tini \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# 先装依赖，利用镜像层缓存
COPY package.json package-lock.json* ./
RUN npm ci --omit=dev || npm install --omit=dev

COPY server ./server
COPY public ./public
COPY test ./test
COPY package.json ./
COPY README.md ./.env.example ./deploy.sh ./
RUN chmod +x deploy.sh

# 非 root 运行
RUN mkdir -p /app/tmp && chown -R node:node /app
USER node

ENV NODE_ENV=production \
    PORT=3000 \
    HOST=0.0.0.0 \
    TMP_DIR=/app/tmp \
    MAX_UPLOAD_MB=500 \
    MAX_DURATION_MIN=360 \
    MAX_CONCURRENT_JOBS=4 \
    MAX_JOBS_PER_IP=2 \
    MAX_SUBMISSIONS_PER_IP_HOUR=20 \
    MAX_TMP_GB=20 \
    JOB_TTL_MIN=60 \
    RETRY_ATTEMPTS=3 \
    RETRY_BASE_MS=5000 \
    CHUNK_CONCURRENCY=2 \
    UPSTREAM_TIMEOUT_MS=900000 \
    CHUNK_TIMEOUT_MS=300000

EXPOSE 3000

VOLUME ["/app/tmp"]

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["node", "server/index.js"]
