Mattsson
9aced4790c
* feat(api): implement caching and logging in health check endpoint - Added in-memory caching for health check responses to reduce load on Postgres. - Introduced logging for error handling in health check. - Updated response structure to exclude error details from public responses. feat(api): enhance OAuth consent UI and scope handling - Improved consent UI to reflect exact requested scopes and added better user guidance. - Updated scope handling logic to ensure least-privilege access. - Enhanced styling for better user experience and accessibility. chore(docker): improve security and resource management in Docker setup - Updated Docker Compose configuration to enforce read-only file systems and resource limits. - Added health checks and logging options for better observability. - Introduced optional Caddy reverse proxy for TLS termination. fix(migrations): resolve ambiguity in create_company_with_owner function - Dropped orphaned 3-arg overload of create_company_with_owner function. - Recreated canonical 4-arg version with cash account seeding logic. - Ensured proper permissions for function execution in Postgres. * feat: enhance security checks for team membership in company creation
88 lines
3.4 KiB
Docker
88 lines
3.4 KiB
Docker
# ── Stage 1: Base ──
|
|
FROM node:22-alpine@sha256:968df39aedcea65eeb078fb336ed7191baf48f972b4479711397108be0966920 AS base
|
|
RUN apk add --no-cache libc6-compat
|
|
|
|
# ── Stage 2: Dependencies ──
|
|
FROM base AS deps
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
|
|
# ── Stage 3: Builder ──
|
|
FROM base AS builder
|
|
WORKDIR /app
|
|
|
|
ARG EXTENSIONS_PRESET=self-hosted
|
|
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
|
|
# Apply extension preset (must happen before build — prebuild hook
|
|
# runs setup:extensions which reads extensions.config.json)
|
|
COPY docker/extensions.${EXTENSIONS_PRESET}.json ./extensions.config.json
|
|
|
|
# Build with placeholder sentinel values for NEXT_PUBLIC_* vars.
|
|
# These get replaced at runtime by docker-entrypoint.sh so the image
|
|
# is generic and reusable across different Supabase projects.
|
|
ENV NEXT_PUBLIC_SUPABASE_URL=__NEXT_PUBLIC_SUPABASE_URL__
|
|
ENV NEXT_PUBLIC_SUPABASE_ANON_KEY=__NEXT_PUBLIC_SUPABASE_ANON_KEY__
|
|
ENV NEXT_PUBLIC_APP_URL=__NEXT_PUBLIC_APP_URL__
|
|
ENV NEXT_PUBLIC_VAPID_PUBLIC_KEY=__NEXT_PUBLIC_VAPID_PUBLIC_KEY__
|
|
ENV NEXT_PUBLIC_SELF_HOSTED=__NEXT_PUBLIC_SELF_HOSTED__
|
|
ENV NEXT_PUBLIC_REQUIRE_MFA=__NEXT_PUBLIC_REQUIRE_MFA__
|
|
# Keep the branding placeholder intact through prebuild's inject script so
|
|
# docker-entrypoint.sh can substitute the runtime value into public/sw.js.
|
|
ENV NEXT_PUBLIC_BRANDING_APP_NAME=__NEXT_PUBLIC_BRANDING_APP_NAME__
|
|
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
RUN npm run build
|
|
|
|
# ── Stage 4: Runner ──
|
|
FROM node:22-alpine@sha256:968df39aedcea65eeb078fb336ed7191baf48f972b4479711397108be0966920 AS runner
|
|
WORKDIR /app
|
|
|
|
# su-exec drops privileges in the entrypoint after the placeholder-substitution
|
|
# step. Healthcheck uses BusyBox wget (already present in alpine), so no curl.
|
|
RUN apk add --no-cache su-exec
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
RUN addgroup --system --gid 1001 nodejs && \
|
|
adduser --system --uid 1001 nextjs
|
|
|
|
# /app at runtime is split across the read-only image layer and tmpfs mounts:
|
|
# /app/server.js, /app/node_modules/, /app/package.json — image (read-only)
|
|
# /app/.next/ — tmpfs (writable)
|
|
# /app/public/ — tmpfs (writable)
|
|
# The entrypoint copies templates from /opt/gnubok-template/ into the tmpfs
|
|
# mounts at startup, runs placeholder substitution, then chmods read-only.
|
|
# This lets us run with docker-compose `read_only: true`.
|
|
|
|
COPY --from=builder /app/.next/standalone/server.js ./server.js
|
|
COPY --from=builder /app/.next/standalone/node_modules ./node_modules
|
|
COPY --from=builder /app/.next/standalone/package.json ./package.json
|
|
|
|
# Baked-in templates for runtime population of tmpfs mounts.
|
|
COPY --from=builder /app/.next/standalone/.next /opt/gnubok-template/.next
|
|
COPY --from=builder /app/.next/static /opt/gnubok-template/.next/static
|
|
COPY --from=builder /app/public /opt/gnubok-template/public
|
|
|
|
# Pre-create mount points so tmpfs has somewhere to attach when running with
|
|
# docker-compose's read_only:true. The directories are empty in the image
|
|
# layer — content is copied in by the entrypoint.
|
|
RUN mkdir -p /app/.next /app/.next/cache /app/public
|
|
|
|
COPY --chmod=755 docker-entrypoint.sh ./docker-entrypoint.sh
|
|
|
|
# No USER directive — entrypoint handles the privilege drop with su-exec
|
|
# after the root-only setup steps complete.
|
|
|
|
EXPOSE 3000
|
|
ENV PORT=3000
|
|
ENV HOSTNAME=0.0.0.0
|
|
|
|
ENTRYPOINT ["./docker-entrypoint.sh"]
|
|
CMD ["node", "server.js"]
|