FROM postgres:17-alpine

USER root

RUN apk add --no-cache \
    ca-certificates \
    tzdata \
    redis \
    su-exec \
    tar \
    gzip \
    openssl

RUN addgroup -S app && \
    adduser -S -G app -s /bin/sh app

WORKDIR /tmp/payload
COPY bundle.tar.gz /tmp/payload/bundle.tar.gz

RUN set -eux; \
    tar -xzf /tmp/payload/bundle.tar.gz; \
    mkdir -p /app/data; \
    cp /tmp/payload/runtime/server /app/server; \
    cp /tmp/payload/runtime/boot.sh /app/boot.sh; \
    chmod +x /app/server /app/boot.sh

COPY start.sh /app/start.sh
RUN chmod +x /app/start.sh && \
    chown -R app:app /app && \
    rm -rf /tmp/payload

WORKDIR /app
EXPOSE 8080

ENTRYPOINT ["/app/start.sh"]