Timo Knuth
53ef4b3b91
Splits the two hostnames across one deployment. No files move: the Next app still serves every route on both hosts, and the middleware decides per host which paths it owns and 301s the rest. /login and /signup stay on www - all 82 marketing CTAs point at /signup, which carries a hard canonical to www plus ad traffic. src/lib/hosts.ts is the single source of truth for the boundary (APP_PATH_PREFIXES, isAppPath, wwwUrl, appUrl, urlForPath). The middleware and every absolute-URL builder read from it so they cannot drift apart. - Split the overloaded NEXT_PUBLIC_APP_URL into a www and an app origin. It previously fed both public URLs and in-app URLs, so any single value was wrong somewhere. Most important: QRCodeCard encodes this origin into the QR code the user downloads and prints, so it must stay on www. - Route Stripe return URLs, email links and OAuth redirects per path rather than against one origin, so /dashboard lands on app and /pricing on www. - Cross the host boundary once, after a successful login: the router cannot push across origins, so that jump needs a full load. The user arrives signed in because the session cookie is scoped to COOKIE_DOMAIN. - Keep the app host out of search indexes: X-Robots-Tag on every response plus a Disallow-all robots.txt via rewrite, and /sitemap.xml redirects to www. - Point the TikTok callback fallback at www explicitly. It used to read NEXT_PUBLIC_APP_URL, whose meaning changed here, and only the apex domain is verified with TikTok. Host splitting is inert while both origins are equal, so development is unaffected. Verified: tsc clean, production build succeeds including the Edge middleware bundle, and the path-to-host mapping is unit-checked (prefix traps like /created and /settings-guide stay on www, query strings do not break matching). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
85 lines
3.1 KiB
Docker
85 lines
3.1 KiB
Docker
# ---- deps ----
|
|
FROM node:20-alpine AS deps
|
|
# Install OpenSSL for Prisma
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* .npmrc* ./
|
|
# Copy prisma schema for postinstall script
|
|
COPY prisma ./prisma
|
|
RUN \
|
|
if [ -f pnpm-lock.yaml ]; then \
|
|
npm i -g pnpm && pnpm i --frozen-lockfile; \
|
|
elif [ -f yarn.lock ]; then \
|
|
yarn --frozen-lockfile; \
|
|
elif [ -f package-lock.json ]; then \
|
|
npm ci; \
|
|
else \
|
|
npm install --legacy-peer-deps; \
|
|
fi
|
|
|
|
# ---- builder ----
|
|
FROM node:20-alpine AS builder
|
|
# Install OpenSSL for Prisma
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
# Add build-time environment variables with defaults
|
|
ENV NEXTAUTH_URL="https://www.qrmaster.net"
|
|
ENV NEXTAUTH_SECRET="build-time-secret"
|
|
ENV IP_SALT="build-time-salt"
|
|
ENV STRIPE_SECRET_KEY="sk_test_placeholder_for_build"
|
|
ENV RESEND_API_KEY="re_placeholder_for_build"
|
|
# Marketing host vs app host. NEXT_PUBLIC_WWW_URL must stay on www: it is the origin
|
|
# encoded into downloaded QR codes and used for public email links.
|
|
ENV NEXT_PUBLIC_WWW_URL="https://www.qrmaster.net"
|
|
ENV NEXT_PUBLIC_APP_URL="https://app.qrmaster.net"
|
|
# PostHog Analytics - REQUIRED at build time for client-side bundle
|
|
ENV NEXT_PUBLIC_POSTHOG_KEY="phc_97JBJVVQlqqiZuTVRHuBnnG9HasOv3GSsdeVjossizJ"
|
|
ENV NEXT_PUBLIC_POSTHOG_HOST="https://us.i.posthog.com"
|
|
ENV NEXT_PUBLIC_INDEXABLE="true"
|
|
ENV NEXT_PUBLIC_FACEBOOK_PIXEL_ID="1601718491252690"
|
|
# Umami Analytics - REQUIRED at build time (NEXT_PUBLIC_* is inlined by the compiler)
|
|
ARG NEXT_PUBLIC_UMAMI_SRC=""
|
|
ARG NEXT_PUBLIC_UMAMI_ID=""
|
|
ENV NEXT_PUBLIC_UMAMI_SRC=$NEXT_PUBLIC_UMAMI_SRC
|
|
ENV NEXT_PUBLIC_UMAMI_ID=$NEXT_PUBLIC_UMAMI_ID
|
|
# Shared session cookie across www.* and app.*. Needed at build time too: process.env is
|
|
# inlined into the Edge middleware bundle, so a runtime-only value would leave the
|
|
# middleware and the route handlers disagreeing about the cookie scope.
|
|
ARG COOKIE_DOMAIN=""
|
|
ENV COOKIE_DOMAIN=$COOKIE_DOMAIN
|
|
RUN npx prisma generate
|
|
RUN npm run build
|
|
|
|
# ---- runner ----
|
|
FROM node:20-alpine AS runner
|
|
# Install OpenSSL for Prisma runtime
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
RUN addgroup --system --gid 1001 nodejs
|
|
RUN adduser --system --uid 1001 nextjs
|
|
|
|
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
|
|
COPY --from=builder --chown=nextjs:nodejs /app/prisma ./prisma
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
COPY --from=builder --chown=nextjs:nodejs /app/public ./public
|
|
COPY --from=builder --chown=nextjs:nodejs /app/docker/entrypoint.sh ./docker/entrypoint.sh
|
|
|
|
RUN chmod +x ./docker/entrypoint.sh
|
|
|
|
# Next writes ISR/prerender artifacts under .next/server/app at runtime.
|
|
RUN mkdir -p /app/.next/cache /app/.next/server/app \
|
|
&& chown -R nextjs:nodejs /app/.next
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["./docker/entrypoint.sh"]
|