FROM node:22-alpine AS builder

WORKDIR /app

COPY package.json ./
RUN npm install

COPY tsconfig.json ./
COPY src ./src
RUN npm run build

FROM node:22-alpine

WORKDIR /app

COPY package.json ./
RUN npm install --omit=dev && npm install @infisical/sdk

COPY --from=builder /app/dist ./dist
COPY scripts ./scripts

ENV INFISICAL_SECRET_PATHS="/geo,/shared"

EXPOSE 8000

CMD ["sh", "-c", "node scripts/load-secrets.mjs && . ./.env.infisical && node dist/index.js"]