# Local Hub API — built from the published @mesh-tech/hub tarball (interim
# until the hub pipeline publishes container images; design §11 risk).
# Build context = the extracted tarball; the CodeArtifact token comes in as
# a BuildKit secret so it never lands in a layer.
FROM node:22-slim@sha256:6c74791e557ce11fc957704f6d4fe134a7bc8d6f5ca4403205b2966bd488f6b3
# socat backs the in-container http://localhost:8080 → zitadel loopback
# forward (see CMD): Zitadel routes every request by Host header to the
# instance whose domain is `localhost`, so the ONE issuer URL that tokens
# carry must resolve inside this container too — same invariant as hosted,
# where the public issuer URL is valid everywhere.
RUN apt-get update && apt-get install -y --no-install-recommends socat && rm -rf /var/lib/apt/lists/*
WORKDIR /hub/api
COPY api/package.json ./package.json
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm install --omit=dev --no-audit --no-fund
COPY api/dist ./dist
ENV PORT=3002
EXPOSE 3002
CMD ["sh", "-c", "socat TCP-LISTEN:8080,bind=127.0.0.1,fork,reuseaddr TCP:zitadel:8080 & exec node dist/index.js"]