# Multistage build to reduce image size and increase security
FROM node:12-alpine AS build

# Install requirements to clone repository and install deps
RUN apk add --no-cache git
RUN npm install -g bower

# Create folder for cryptpad
RUN mkdir /cryptpad
WORKDIR /cryptpad

# Get cryptpad from repository submodule
COPY cryptpad /cryptpad

RUN sed -i "s@//httpAddress: '::'@httpAddress: '0.0.0.0'@" /cryptpad/config/config.example.js
RUN sed -i "s@httpUnsafeOrigin: '(.*)'@httpUnsafeOrigin: process.env.CRYPTPAD_HTTP_UNSAFE_ORIGIN@" /cryptpad/config/config.example.js
RUN sed -i 's@// httpSafeOrigin: "(.*)""@httpSafeOrigin: process.env.CRYPTPAD_HTTP_SAFE_ORIGIN@' /cryptpad/config/config.example.js

# Install dependencies
RUN npm install --production \
    && npm install -g bower \
    && bower install --allow-root

# Create actual cryptpad image
FROM node:12-alpine

ENV CRYPTPAD_HTTP_UNSAFE_ORIGIN http://localhost:3001
ENV CRYPTPAD_HTTP_SAFE_ORIGIN http://localhost:3001

# Install process management tool
RUN apk add --no-cache supervisor nginx

# Create user and group for cryptpad so it does not run as root
RUN addgroup -g 4001 -S cryptpad \
    && adduser -u 4001 -S -D -g 4001 -H -h /cryptpad cryptpad

# Copy cryptpad with installed modules
COPY --from=build --chown=cryptpad /cryptpad /cryptpad
USER cryptpad

# Set workdir to cryptpad
WORKDIR /cryptpad

# Create directories
RUN mkdir blob block customize data datastore

# Volumes for data persistence
VOLUME /cryptpad/blob
VOLUME /cryptpad/block
VOLUME /cryptpad/customize
VOLUME /cryptpad/data
VOLUME /cryptpad/datastore

# Start supervisord as root
USER root

# Configure supervisord
ADD nginx/supervisord.conf /etc/supervisor/supervisord.conf

# Ports
EXPOSE 3000 3001

# Run supervisord on startup
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]