Hartmut
4a5edeef3e
CI / Unit Tests (pull_request) Successful in 5m46s
CI / Lint (pull_request) Failing after 3m49s
CI / E2E Tests (pull_request) Has been skipped
CI / Fresh-Linux Docker Deploy (pull_request) Has been skipped
CI / Assistant Split Regression (pull_request) Failing after 35s
CI / Architecture Guardrails (pull_request) Failing after 2m14s
CI / Typecheck (pull_request) Successful in 4m22s
CI / Build (pull_request) Has been skipped
CI / Release Images (pull_request) Has been skipped
- @capakraken/* → @nexus/* across 12 packages (root + 11 workspaces),
1551 import lines migrated via codemod
- User-visible brand strings renamed (emails, page titles, PWA
manifest, mobile header, MFA backup-codes header, tooltips, signin
page, invite page, weekly digest, install prompt)
- TOTP issuer "CapaKraken" → "Nexus" (existing secrets still valid;
re-enrollment relabels them in users' authenticator apps)
- Function rename: assertCapaKrakenDbTarget → assertNexusDbTarget
- LocalStorage migration shim in apps/web/src/app/layout.tsx copies
capakraken_* → nexus_* on first load (guarded by nexus_migrated_v1
sentinel; runs once per browser, then never again)
- Service-worker cache name capakraken-v2 → nexus-v2 with one-time
caches.delete('capakraken-v2') from the same shim
- Email-domain fixtures @capakraken.{dev,app} → @nexus.{dev,app} in
seed data, e2e specs, SMTP default fallback
- Dockerfile.dev / Dockerfile.prod / all .github/workflows/*.yml
pnpm --filter @capakraken/* → @nexus/*
- README, CLAUDE.md, LEARNINGS.md, all docs/*.md, .env.example,
tooling/deploy/.env.production.example brand sweep
Phase 1 deliberately leaves untouched (handled in Phase 3 cutover):
- PostgreSQL DB name "capakraken" and POSTGRES_USER "capakraken"
- Volume names capakraken_pgdata etc.
- Compose project name "capakraken" / "capakraken-prod"
- db-target-guard default expectedDatabase
- env-var CAPAKRAKEN_EXPECTED_DB_NAME
- Container DNS names in docker-compose.ci.yml
Quality gates green: pnpm typecheck (7/7), pnpm test:unit (7/7),
pnpm lint (0 errors), check:exports/imports/architecture all pass.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
109 lines
3.7 KiB
Docker
109 lines
3.7 KiB
Docker
# ============================================================
|
|
# Stage 1: Install dependencies
|
|
# ============================================================
|
|
FROM node:20-bookworm-slim AS deps
|
|
|
|
RUN apt-get update -y && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*
|
|
RUN npm install -g pnpm@9.14.2
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace manifests first for better layer caching
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
|
|
COPY tooling/ ./tooling/
|
|
COPY packages/shared/package.json ./packages/shared/
|
|
COPY packages/db/package.json ./packages/db/
|
|
COPY packages/engine/package.json ./packages/engine/
|
|
COPY packages/staffing/package.json ./packages/staffing/
|
|
COPY packages/application/package.json ./packages/application/
|
|
COPY packages/api/package.json ./packages/api/
|
|
COPY packages/ui/package.json ./packages/ui/
|
|
COPY apps/web/package.json ./apps/web/
|
|
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# ============================================================
|
|
# Stage 2: Build the application
|
|
# ============================================================
|
|
FROM node:20-bookworm-slim AS builder
|
|
|
|
RUN apt-get update -y && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*
|
|
RUN npm install -g pnpm@9.14.2
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy installed dependencies from stage 1
|
|
COPY --from=deps /app/ ./
|
|
|
|
# Copy all source code
|
|
COPY . .
|
|
|
|
# Generate Prisma client
|
|
RUN pnpm --filter @nexus/db db:generate
|
|
|
|
# Build the Next.js application
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV NODE_ENV=production
|
|
# next build collects page data for /api/auth/[...nextauth] which crashes
|
|
# without these envs even though they are placeholders at image-build time
|
|
# (real values are injected at container start). Mirrors the CI build job.
|
|
#
|
|
# IMPORTANT: pass these only as inline env on the RUN step, not via `ENV`.
|
|
# `ENV` persists the placeholder into the image layer — scanned as a leaked
|
|
# secret and inherited by the `migrator` stage (which is published).
|
|
ARG NEXTAUTH_URL=http://localhost:3100
|
|
ARG AUTH_URL=http://localhost:3100
|
|
ARG NEXTAUTH_SECRET=ci-build-placeholder-secret-minimum-32-chars
|
|
ARG AUTH_SECRET=ci-build-placeholder-secret-minimum-32-chars
|
|
ARG DATABASE_URL=postgresql://placeholder:placeholder@localhost:5432/placeholder
|
|
ARG REDIS_URL=redis://placeholder:6379
|
|
RUN NEXTAUTH_URL="$NEXTAUTH_URL" \
|
|
AUTH_URL="$AUTH_URL" \
|
|
NEXTAUTH_SECRET="$NEXTAUTH_SECRET" \
|
|
AUTH_SECRET="$AUTH_SECRET" \
|
|
DATABASE_URL="$DATABASE_URL" \
|
|
REDIS_URL="$REDIS_URL" \
|
|
pnpm --filter @nexus/web build
|
|
|
|
# ============================================================
|
|
# Stage 3: Migration runner
|
|
# ============================================================
|
|
FROM builder AS migrator
|
|
|
|
ENV NODE_ENV=production
|
|
|
|
CMD ["pnpm", "--filter", "@nexus/db", "db:migrate:deploy"]
|
|
|
|
# ============================================================
|
|
# Stage 4: Production runtime
|
|
# ============================================================
|
|
FROM node:20-bookworm-slim AS runner
|
|
|
|
RUN apt-get update -y && apt-get install -y openssl curl && rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV HOSTNAME=0.0.0.0
|
|
ENV PORT=3000
|
|
|
|
RUN addgroup --system --gid 1001 nodejs && \
|
|
adduser --system --uid 1001 nextjs
|
|
|
|
# Copy the standalone output (includes server.js and node_modules)
|
|
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
|
|
|
|
# Copy static assets and public files
|
|
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
|
|
COPY --from=builder --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD curl -f http://localhost:3000/api/health || exit 1
|
|
|
|
CMD ["node", "apps/web/server.js"]
|