# Portal, from the release tarball uhhm/portal publishes on
# project.uhhm.no (the same artifact the bare-metal instances run).
# PORTAL_RELEASE in .env pins the version; bumping it and rebuilding is
# the whole upgrade.
FROM debian:bookworm-slim
ARG PORTAL_RELEASE
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl \
 && rm -rf /var/lib/apt/lists/*
WORKDIR /app
RUN curl -sfL "https://project.uhhm.no/uhhm/portal/releases/download/${PORTAL_RELEASE}/portal-${PORTAL_RELEASE}.tar.gz" \
    | tar -xz -C /app \
 && test -x /app/portal
# A non-root user; the image ships nothing writable it needs.
RUN useradd --system --no-create-home portal
USER portal
EXPOSE 3000
CMD ["/app/portal"]