sakshamandClaude Sonnet 5
086ca1f13f
Sets up everything needed to deploy behind Cloudflare with a self-hosted git server: multi-stage prod Dockerfiles (non-root), docker-compose.prod.yml (Postgres/Redis with no host ports, Nginx reverse proxy, Gitea with public-read/admin-write access control), scripts/bootstrap-env.sh to auto-generate required secrets on first clone, and DEPLOYMENT.md covering the full runbook. Provider API keys (Anthropic/Brave/NinjaPear/USPTO/ Turnstile) are deliberately kept out of .env in favor of the existing DB-backed Settings UI, so the public repo stays safe to expose. Also fixes two bugs only surfaced by live-testing the prod stack: Celery beat couldn't write its schedule file as a non-root user, and Gitea's embedded SSH server conflicted with the base image's own sshd on port 22. Co-Authored-By: Claude Sonnet 5 <[email protected]>
40 lines
1.2 KiB
Docker
40 lines
1.2 KiB
Docker
# Production image for the Next.js frontend - built with `next build`
|
|
# (output: "standalone" in next.config.js), served with `node server.js`,
|
|
# not `next dev`/`npm start`. See infrastructure/docker/web.Dockerfile for
|
|
# the dev image (kept separate and untouched).
|
|
|
|
FROM node:20-alpine AS deps
|
|
WORKDIR /app
|
|
COPY apps/web/package.json apps/web/package-lock.json* ./
|
|
RUN npm ci
|
|
|
|
|
|
FROM node:20-alpine AS builder
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY apps/web ./
|
|
# Baked into the browser bundle at build time - must be the public URL the
|
|
# *browser* will use, not a Docker-internal service name. See .env.example.
|
|
ARG NEXT_PUBLIC_API_URL
|
|
ARG NEXT_PUBLIC_GIT_REPO_URL
|
|
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL} \
|
|
NEXT_PUBLIC_GIT_REPO_URL=${NEXT_PUBLIC_GIT_REPO_URL}
|
|
RUN npm run build
|
|
|
|
|
|
FROM node:20-alpine AS runner
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjs
|
|
|
|
# output:"standalone" already traces only the files actually needed at
|
|
# runtime - no full node_modules copy required.
|
|
COPY --from=builder /app/.next/standalone ./
|
|
COPY --from=builder /app/.next/static ./.next/static
|
|
COPY --from=builder /app/public ./public
|
|
|
|
USER nextjs
|
|
EXPOSE 3000
|
|
|
|
CMD ["node", "server.js"]
|