FROM node:20-alpine

WORKDIR /app

# Install dependencies first so this layer is cached unless package*.json changes.
# --ignore-scripts skips the "postinstall: bower install" step - bower only
# manages legacy frontend assets under public/lib, not needed by the payment API.
COPY package.json package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts --legacy-peer-deps

COPY . .

RUN mkdir -p log && chown -R node:node /app
USER node

ENV NODE_ENV=production
EXPOSE 3003

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
    CMD wget -qO- http://127.0.0.1:3003/ >/dev/null || exit 1

CMD ["node", "server.js"]
