FROM amd64/nginx

# RUN echo "hello world"
# Setting up base directory for audience-manager
ENV BASE_DIR=/var/www/capillary/audience-manager
RUN echo $BASE_DIR

# Create non-root group and user (UID/GID 1000, username matches application name)
RUN groupadd -g 1000 audience-manager && \
    useradd -u 1000 -g audience-manager -m -s /bin/bash audience-manager

# Create app directory and grant non-root user access to nginx runtime directories
RUN mkdir -p $BASE_DIR && \
    chown -R audience-manager:audience-manager $BASE_DIR && \
    chown -R audience-manager:audience-manager /var/cache/nginx && \
    chown -R audience-manager:audience-manager /var/log/nginx && \
    chown -R audience-manager:audience-manager /etc/nginx/conf.d && \
    touch /var/run/nginx.pid && \
    chown audience-manager:audience-manager /var/run/nginx.pid

# Copying generated dist directory at the time of deployer build to base directory
# dist files need non-root ownership so entrypoint.sh can sed -i index.html at runtime
COPY --chown=audience-manager:audience-manager dist $BASE_DIR

# Audience manager UI app nginx rule
COPY --chown=audience-manager:audience-manager nginx/default.conf /etc/nginx/conf.d/default.conf

# Copy and make entrypoint executable as root before switching user
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Working directory
WORKDIR $BASE_DIR

# Switch to non-root user before runtime
USER audience-manager

# Exposing port 80
EXPOSE 80

ENTRYPOINT ["/entrypoint.sh"]