Hartmut
805bb0464f
- docker-compose.yml: require ${POSTGRES_PASSWORD} for the postgres service
and the app container's DATABASE_URL. No default — compose refuses to start
without it, mirroring the existing PGADMIN_PASSWORD pattern.
- Dockerfile.prod: move auth/db ENV assignments from persistent ENV lines into
an inline env prefix on the `pnpm build` RUN step. Placeholders are still
available to `next build` but no longer persist in the builder layer or in
the published migrator image (which is FROM builder).
- Dockerfile.dev: add HEALTHCHECK against /api/health and install curl for it.
- .dockerignore: cover nested **/.env*, **/*.pem, **/*.key, **/secrets/**.
- runtime-env.ts: add the CI build placeholder strings to the disallowed-secret
set so a misconfigured prod deploy using the baked-in ARG defaults fails
startup instead of silently running with a known-bad secret.
- .env.example: document the new POSTGRES_PASSWORD requirement.
- CI: write POSTGRES_PASSWORD into the Fresh-Linux Docker Deploy job's .env
(must match docker-compose.ci.yml's hardcoded DATABASE_URL), and provide a
dummy value in the E2E job where compose validates all services' interp.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
37 lines
1.1 KiB
Docker
37 lines
1.1 KiB
Docker
FROM node:20-bookworm-slim AS base
|
|
|
|
# Prisma needs OpenSSL; curl is used by HEALTHCHECK below.
|
|
RUN apt-get update -y && apt-get install -y openssl postgresql-client curl && rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install pnpm
|
|
RUN npm install -g pnpm@9.14.2
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace manifests
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
|
|
COPY tooling/ ./tooling/
|
|
COPY packages/shared/package.json ./packages/shared/
|
|
COPY packages/db/package.json ./packages/db/
|
|
COPY packages/engine/package.json ./packages/engine/
|
|
COPY packages/staffing/package.json ./packages/staffing/
|
|
COPY packages/application/package.json ./packages/application/
|
|
COPY packages/api/package.json ./packages/api/
|
|
COPY apps/web/package.json ./apps/web/
|
|
|
|
# Install dependencies
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy all sources
|
|
COPY . .
|
|
|
|
# Generate Prisma client
|
|
RUN pnpm --filter @capakraken/db db:generate
|
|
|
|
EXPOSE 3100
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD curl -fsS http://localhost:3100/api/health || exit 1
|
|
|
|
CMD ["sh", "./tooling/docker/app-dev-start.sh"]
|