FROM node:20-alpine
WORKDIR /app

# Prisma's engine detection needs libssl present at `npm ci` time (when
# `postinstall` runs `prisma generate`) — without it, Prisma can't detect
# the OpenSSL version and silently picks the wrong engine binary, which
# only fails later at runtime when a query actually tries to run.
RUN apk add --no-cache openssl

COPY package.json package-lock.json ./
COPY prisma ./prisma
RUN npm ci

COPY . .
RUN npm run build

ENV NODE_ENV=production
EXPOSE 3000
CMD ["npm", "start"]