Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

Dockerfile

@@ -11,7 +11,7 @@ RUN npm install --omit=dev
 FROM node:22-bookworm-slim
 ENV NODE_ENV=production
 RUN apt-get update \
- && apt-get install -y --no-install-recommends openssl ca-certificates tini \
+ && apt-get install -y --no-install-recommends openssl ca-certificates tini util-linux \
  && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 
@@ -20,14 +20,19 @@ COPY package.json ./
 COPY src ./src
 COPY public ./public
 COPY scripts ./scripts
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 
-RUN mkdir -p /data/photos && chown -R node:node /data /app
-USER node
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh \
+ && mkdir -p /data/photos /data/certs \
+ && chown -R node:node /data /app
+
+# Starts as root only long enough to fix ownership of a bind-mounted /data,
+# then the entrypoint drops to the node user before running anything.
 VOLUME ["/data"]
 EXPOSE 3000 3001
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
   CMD node scripts/healthcheck.mjs
 
-ENTRYPOINT ["/usr/bin/tini", "--"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
 CMD ["node", "src/server.js"]