Timo Knuth
113acc073f
Groundwork for testmodul.qrmaster.net, a second stack running the `test` branch on a real qrmaster.net subdomain. Production scopes its session cookie to .qrmaster.net, so the browser sends it to every subdomain including staging. With both environments naming the cookie `userId`, the browser holds two cookies of the same name and cookies.get() picks one arbitrarily - staging logins would look randomly signed-out. AUTH_COOKIE_NAME lets staging pick `userId_test` instead. Production keeps the `userId` default; changing it there would invalidate every existing session. Wired getAuthCookieName() into the six places that named the cookie literally. The account deletion route now expires both the host-only and the domain-scoped variant like the logout route already does, instead of a single cookies().delete() that would leave the other one behind. NEXT_PUBLIC_WWW_URL and NEXT_PUBLIC_APP_URL become build ARGs so the same image can be built pointing at the staging host - the defaults keep a plain production build byte identical to before. Like COOKIE_DOMAIN these must exist at build time, because process.env is inlined into the Edge middleware bundle. robots.ts now serves Disallow-all unless NEXT_PUBLIC_INDEXABLE is true. Staging otherwise returns the production robots.txt and invites crawlers to index a duplicate of www. docker-compose.test.yml is the staging overlay. Two things it must get right, both verified against `docker compose config`: - db and redis need `networks: !override`. Compose MERGES the networks mapping from the base file, and since qrmaster-network is external and shared, a plain list left them attached to it - `db` would then resolve to two containers and staging could read and write the production database. - The web entrypoint is replaced so `prisma migrate deploy` never runs. prisma/migrations stopped in April 2026 and the schema has moved on through manual SQL since, so applying them to a fresh database would build a stale schema. Staging gets its schema from `pg_dump --schema-only` against production instead. Verified: tsc clean, production build succeeds, and the merged compose config confirms staging keeps db/redis off the shared network while production resolves unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
93 lines
3.6 KiB
Docker
93 lines
3.6 KiB
Docker
# ---- deps ----
|
|
FROM node:20-alpine AS deps
|
|
# Install OpenSSL for Prisma
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* .npmrc* ./
|
|
# Copy prisma schema for postinstall script
|
|
COPY prisma ./prisma
|
|
RUN \
|
|
if [ -f pnpm-lock.yaml ]; then \
|
|
npm i -g pnpm && pnpm i --frozen-lockfile; \
|
|
elif [ -f yarn.lock ]; then \
|
|
yarn --frozen-lockfile; \
|
|
elif [ -f package-lock.json ]; then \
|
|
npm ci; \
|
|
else \
|
|
npm install --legacy-peer-deps; \
|
|
fi
|
|
|
|
# ---- builder ----
|
|
FROM node:20-alpine AS builder
|
|
# Install OpenSSL for Prisma
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
# Add build-time environment variables with defaults
|
|
ENV NEXTAUTH_URL="https://www.qrmaster.net"
|
|
ENV NEXTAUTH_SECRET="build-time-secret"
|
|
ENV IP_SALT="build-time-salt"
|
|
ENV STRIPE_SECRET_KEY="sk_test_placeholder_for_build"
|
|
ENV RESEND_API_KEY="re_placeholder_for_build"
|
|
# Marketing host vs app host. NEXT_PUBLIC_WWW_URL must stay on www in production: it is the
|
|
# origin encoded into downloaded QR codes and used for public email links.
|
|
# Declared as ARG so the staging overlay can build the same image pointing at
|
|
# testmodul.qrmaster.net - the defaults keep a plain production build unchanged.
|
|
ARG NEXT_PUBLIC_WWW_URL="https://www.qrmaster.net"
|
|
ENV NEXT_PUBLIC_WWW_URL=$NEXT_PUBLIC_WWW_URL
|
|
ARG NEXT_PUBLIC_APP_URL="https://app.qrmaster.net"
|
|
ENV NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL
|
|
# PostHog Analytics - REQUIRED at build time for client-side bundle
|
|
ENV NEXT_PUBLIC_POSTHOG_KEY="phc_97JBJVVQlqqiZuTVRHuBnnG9HasOv3GSsdeVjossizJ"
|
|
ENV NEXT_PUBLIC_POSTHOG_HOST="https://us.i.posthog.com"
|
|
ENV NEXT_PUBLIC_INDEXABLE="true"
|
|
ENV NEXT_PUBLIC_FACEBOOK_PIXEL_ID="1601718491252690"
|
|
# Umami Analytics - REQUIRED at build time (NEXT_PUBLIC_* is inlined by the compiler)
|
|
ARG NEXT_PUBLIC_UMAMI_SRC=""
|
|
ARG NEXT_PUBLIC_UMAMI_ID=""
|
|
ENV NEXT_PUBLIC_UMAMI_SRC=$NEXT_PUBLIC_UMAMI_SRC
|
|
ENV NEXT_PUBLIC_UMAMI_ID=$NEXT_PUBLIC_UMAMI_ID
|
|
# Shared session cookie across www.* and app.*. Needed at build time too: process.env is
|
|
# inlined into the Edge middleware bundle, so a runtime-only value would leave the
|
|
# middleware and the route handlers disagreeing about the cookie scope.
|
|
ARG COOKIE_DOMAIN=""
|
|
ENV COOKIE_DOMAIN=$COOKIE_DOMAIN
|
|
# Distinct session cookie name for the staging deployment, so its cookie cannot collide
|
|
# with the production one the browser also sends to testmodul.qrmaster.net.
|
|
ARG AUTH_COOKIE_NAME=""
|
|
ENV AUTH_COOKIE_NAME=$AUTH_COOKIE_NAME
|
|
RUN npx prisma generate
|
|
RUN npm run build
|
|
|
|
# ---- runner ----
|
|
FROM node:20-alpine AS runner
|
|
# Install OpenSSL for Prisma runtime
|
|
RUN apk add --no-cache openssl
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
RUN addgroup --system --gid 1001 nodejs
|
|
RUN adduser --system --uid 1001 nextjs
|
|
|
|
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
|
|
COPY --from=builder --chown=nextjs:nodejs /app/prisma ./prisma
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
COPY --from=builder --chown=nextjs:nodejs /app/public ./public
|
|
COPY --from=builder --chown=nextjs:nodejs /app/docker/entrypoint.sh ./docker/entrypoint.sh
|
|
|
|
RUN chmod +x ./docker/entrypoint.sh
|
|
|
|
# Next writes ISR/prerender artifacts under .next/server/app at runtime.
|
|
RUN mkdir -p /app/.next/cache /app/.next/server/app \
|
|
&& chown -R nextjs:nodejs /app/.next
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["./docker/entrypoint.sh"]
|