FROM node:20-alpine

# Alpine images have no timezone data by default - without this, Date/moment()
# fall back to UTC inside the container regardless of the host's real timezone,
# which showed up as every displayed/signed timestamp being 7 hours behind
# actual Vietnam time (UTC+7, no DST).
RUN apk add --no-cache tzdata
ENV TZ=Asia/Ho_Chi_Minh

WORKDIR /app

# Install dependencies first so this layer is cached unless package*.json changes.
# --ignore-scripts skips the "postinstall: bower install" step - bower only
# manages legacy frontend assets under public/lib, not needed by the payment API.
COPY package.json package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts --legacy-peer-deps

COPY . .

RUN mkdir -p log && chown -R node:node /app
USER node

ENV NODE_ENV=production
EXPOSE 3003

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
    CMD wget -qO- http://127.0.0.1:3003/ >/dev/null || exit 1

CMD ["node", "server.js"]
