FROM node:22-slim

# ca-certificates is REQUIRED, not optional: node:22-slim ships no system CA
# store. Node bundles its own so JS fetch works, but the Codex CLI is a Rust
# binary and validates TLS against the system store — without this every HTTPS
# call (incl. `codex login`) dies after the TCP/proxy connect with a generic
# "error sending request". Cost us a long debug; do not drop it.
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/*

RUN npm install -g @openai/codex

WORKDIR /workspace

COPY server.js /app/server.js

# Codex reads auth + config from $CODEX_HOME (default ~/.codex). Pinned
# explicitly so the compose volume mount and the config writer agree.
ENV CODEX_HOME=/root/.codex

EXPOSE 8010

ENTRYPOINT ["node", "/app/server.js"]