# Prepared by prepare-image.py from a checksum-pinned source archive. The build
# context contains only reviewed source, build controls and public license data.
FROM node:22.22.3-bookworm-slim@sha256:e21fc383b50d5347dc7a9f1cae45b8f4e2f0d39f7ade28e4eef7d2934522b752 AS node-runtime
FROM ghcr.io/gitroomhq/postiz-app:v2.25.0@sha256:7eb4a553507ce3f200deff2ec0211ab3cf834ba19eb44dd68e83ccc236509feb
COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
WORKDIR /app
COPY release /opt/rghl/release
COPY corresponding-source.tar.gz /opt/rghl/source/corresponding-source.tar.gz
RUN --network=none node /opt/rghl/release/image-check.cjs before
COPY overlay /app
# Match the verified compiler heap without changing the production runtime limit.
RUN --network=none export NODE_OPTIONS=--max-old-space-size=4096 \
    && pnpm exec prisma generate --schema libraries/nestjs-libraries/src/database/prisma/schema.prisma \
    && pnpm run build:backend \
    && pnpm run build:orchestrator
RUN --network=none node /opt/rghl/release/image-check.cjs seal
COPY release/nginx.conf /etc/nginx/nginx.conf
RUN --network=none nginx -t
ENV RGHL_MANAGED_CANCELLATION=false
ENV RGHL_CANCELLATION_CONFIRMATION=false
LABEL org.opencontainers.image.title="Postiz with managed publication guard" \
      org.opencontainers.image.revision="8e42f09cb45c3b6be16656c2d23a372d5eb21053" \
      org.opencontainers.image.licenses="AGPL-3.0-only"
ENTRYPOINT ["node", "/opt/rghl/release/start.cjs"]
HEALTHCHECK --interval=30s --timeout=15s --start-period=120s --retries=10 CMD node /opt/rghl/release/health.mjs
