# Key server + bundle builder.
# cryptsetup-bin: re-keys each downloaded lock-bundle's vault to that box's own
# key (file-header operations only — needs no privileges, no device-mapper).
FROM node:20-slim
RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends cryptsetup-bin \
    && rm -rf /var/lib/apt/lists/*
WORKDIR /app
CMD ["node", "keyserver.js"]