sakshamandClaude Sonnet 5
3d6fe56991
Local dev gets an unauthenticated Adminer instance bound to loopback only. In production, any account with is_admin=true can open it - the app mints a short-lived token from a live admin session, which Nginx's new db.ciagent.org block exchanges for a session cookie that re-checks admin status on every request, instead of a shared static password that wouldn't scale to multiple admins or revoke live. Co-Authored-By: Claude Sonnet 5 <[email protected]>
42 lines
1.3 KiB
Docker
42 lines
1.3 KiB
Docker
# Production image for the Next.js frontend - built with `next build`
|
|
# (output: "standalone" in next.config.js), served with `node server.js`,
|
|
# not `next dev`/`npm start`. See infrastructure/docker/web.Dockerfile for
|
|
# the dev image (kept separate and untouched).
|
|
|
|
FROM node:20-alpine AS deps
|
|
WORKDIR /app
|
|
COPY apps/web/package.json apps/web/package-lock.json* ./
|
|
RUN npm ci
|
|
|
|
|
|
FROM node:20-alpine AS builder
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY apps/web ./
|
|
# Baked into the browser bundle at build time - must be the public URL the
|
|
# *browser* will use, not a Docker-internal service name. See .env.example.
|
|
ARG NEXT_PUBLIC_API_URL
|
|
ARG NEXT_PUBLIC_GIT_REPO_URL
|
|
ARG NEXT_PUBLIC_DB_VIEWER_URL
|
|
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL} \
|
|
NEXT_PUBLIC_GIT_REPO_URL=${NEXT_PUBLIC_GIT_REPO_URL} \
|
|
NEXT_PUBLIC_DB_VIEWER_URL=${NEXT_PUBLIC_DB_VIEWER_URL}
|
|
RUN npm run build
|
|
|
|
|
|
FROM node:20-alpine AS runner
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nextjs
|
|
|
|
# output:"standalone" already traces only the files actually needed at
|
|
# runtime - no full node_modules copy required.
|
|
COPY --from=builder /app/.next/standalone ./
|
|
COPY --from=builder /app/.next/static ./.next/static
|
|
COPY --from=builder /app/public ./public
|
|
|
|
USER nextjs
|
|
EXPOSE 3000
|
|
|
|
CMD ["node", "server.js"]
|