Timo Knuth
35ea8cc3e9
Groundwork for moving the app to app.qrmaster.net: the session has to survive the host change from www.qrmaster.net to app.qrmaster.net. - Add COOKIE_DOMAIN and apply it to the auth, CSRF, attribution and OAuth flow cookies. Honoured only in production, because browsers reject dotted domains on localhost - a prod .env copied into a dev environment would otherwise break every login instead of just ignoring the value. - Expire both the host-only and the domain-scoped variant on logout. Next's ResponseCookies is keyed by cookie name and rewrites the entire set-cookie header from its internal map on every set(), so the two variants must be appended manually - otherwise one overwrites the other and the surviving stale cookie keeps the user signed in. - Pass COOKIE_DOMAIN as both build arg and runtime env: process.env is inlined into the Edge middleware bundle, so a runtime-only value would leave the middleware and the route handlers disagreeing about the cookie scope. No behaviour change while COOKIE_DOMAIN is unset. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
82 lines
2.9 KiB
Docker
82 lines
2.9 KiB
Docker
# ---- deps ----
|
|
FROM node:20-alpine AS deps
|
|
# Install OpenSSL for Prisma
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* .npmrc* ./
|
|
# Copy prisma schema for postinstall script
|
|
COPY prisma ./prisma
|
|
RUN \
|
|
if [ -f pnpm-lock.yaml ]; then \
|
|
npm i -g pnpm && pnpm i --frozen-lockfile; \
|
|
elif [ -f yarn.lock ]; then \
|
|
yarn --frozen-lockfile; \
|
|
elif [ -f package-lock.json ]; then \
|
|
npm ci; \
|
|
else \
|
|
npm install --legacy-peer-deps; \
|
|
fi
|
|
|
|
# ---- builder ----
|
|
FROM node:20-alpine AS builder
|
|
# Install OpenSSL for Prisma
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
# Add build-time environment variables with defaults
|
|
ENV NEXTAUTH_URL="https://www.qrmaster.net"
|
|
ENV NEXTAUTH_SECRET="build-time-secret"
|
|
ENV IP_SALT="build-time-salt"
|
|
ENV STRIPE_SECRET_KEY="sk_test_placeholder_for_build"
|
|
ENV RESEND_API_KEY="re_placeholder_for_build"
|
|
ENV NEXT_PUBLIC_APP_URL="https://www.qrmaster.net"
|
|
# PostHog Analytics - REQUIRED at build time for client-side bundle
|
|
ENV NEXT_PUBLIC_POSTHOG_KEY="phc_97JBJVVQlqqiZuTVRHuBnnG9HasOv3GSsdeVjossizJ"
|
|
ENV NEXT_PUBLIC_POSTHOG_HOST="https://us.i.posthog.com"
|
|
ENV NEXT_PUBLIC_INDEXABLE="true"
|
|
ENV NEXT_PUBLIC_FACEBOOK_PIXEL_ID="1601718491252690"
|
|
# Umami Analytics - REQUIRED at build time (NEXT_PUBLIC_* is inlined by the compiler)
|
|
ARG NEXT_PUBLIC_UMAMI_SRC=""
|
|
ARG NEXT_PUBLIC_UMAMI_ID=""
|
|
ENV NEXT_PUBLIC_UMAMI_SRC=$NEXT_PUBLIC_UMAMI_SRC
|
|
ENV NEXT_PUBLIC_UMAMI_ID=$NEXT_PUBLIC_UMAMI_ID
|
|
# Shared session cookie across www.* and app.*. Needed at build time too: process.env is
|
|
# inlined into the Edge middleware bundle, so a runtime-only value would leave the
|
|
# middleware and the route handlers disagreeing about the cookie scope.
|
|
ARG COOKIE_DOMAIN=""
|
|
ENV COOKIE_DOMAIN=$COOKIE_DOMAIN
|
|
RUN npx prisma generate
|
|
RUN npm run build
|
|
|
|
# ---- runner ----
|
|
FROM node:20-alpine AS runner
|
|
# Install OpenSSL for Prisma runtime
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
RUN addgroup --system --gid 1001 nodejs
|
|
RUN adduser --system --uid 1001 nextjs
|
|
|
|
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
|
|
COPY --from=builder --chown=nextjs:nodejs /app/prisma ./prisma
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
COPY --from=builder --chown=nextjs:nodejs /app/public ./public
|
|
COPY --from=builder --chown=nextjs:nodejs /app/docker/entrypoint.sh ./docker/entrypoint.sh
|
|
|
|
RUN chmod +x ./docker/entrypoint.sh
|
|
|
|
# Next writes ISR/prerender artifacts under .next/server/app at runtime.
|
|
RUN mkdir -p /app/.next/cache /app/.next/server/app \
|
|
&& chown -R nextjs:nodejs /app/.next
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["./docker/entrypoint.sh"]
|