Aravind
f397e94418
sessionToken.ts throws when AUTH_SECRET is unset under NODE_ENV=production, so /api/auth/login answered 500 on valid credentials while still returning 401/400 correctly on bad ones. Verified against platform.loyaly.ai, whose responses match that signature exactly. Also reverts NEXT_PUBLIC_API_BASE. platform.loyaly.ai is this same app already deployed (identical /login markup), so the override pointed the app at itself cross-origin, and that endpoint returns no CORS headers. Verified on the production build: valid credentials 200 + session cookie, wrong password 401, malformed 400, and the cookie opens /dashboard, /settings, /stores and /api/stores while an unauthenticated request still gets 307/401. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
63 lines
2.1 KiB
Docker
63 lines
2.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Stage 1: Install dependencies
|
|
FROM node:22-alpine AS deps
|
|
RUN apk add --no-cache libc6-compat
|
|
WORKDIR /app
|
|
|
|
COPY package.json package-lock.json ./
|
|
# devDeps are required to build (typescript, tailwind, eslint-config-next).
|
|
# This whole stage is discarded — none of it reaches the runner.
|
|
RUN npm ci --no-audit --no-fund
|
|
|
|
# Stage 2: Build the Next.js application
|
|
FROM node:22-alpine AS builder
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV NODE_ENV=production
|
|
# Each Docker build starts from a clean layer, so Turbopack's .next/cache is
|
|
# written but never restored. Skipping it cuts ~20% of build CPU (the metric
|
|
# that matters on a 1-vCPU host) and 116 MB off this layer.
|
|
ENV CI_BUILD=1
|
|
|
|
RUN npm run build
|
|
|
|
# Stage 3: Production runner with Next.js Standalone
|
|
FROM node:22-alpine AS runner
|
|
RUN apk add --no-cache libc6-compat
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV PORT=3000
|
|
ENV HOSTNAME="0.0.0.0"
|
|
|
|
# Session-signing key. sessionToken.ts throws when this is unset under
|
|
# NODE_ENV=production, which is why /api/auth/login answered 500 on valid
|
|
# credentials while still returning 401/400 correctly on bad ones.
|
|
#
|
|
# This value is in git: anyone who can read the repo can forge a session
|
|
# cookie for any user. Rotate by replacing it here (invalidates live
|
|
# sessions), or move it to a Dokploy env var, which overrides this line.
|
|
ENV AUTH_SECRET=a0123c7b1508b647cf0f3985ac95644f520d3bcb2695c96a85c3f5db8b0461da
|
|
|
|
# Run as a non-root user; nextjs owns nothing it does not need to write.
|
|
RUN addgroup -g 1001 -S nodejs && adduser -u 1001 -S nextjs -G nodejs
|
|
|
|
# Copy public static assets and standalone build output.
|
|
# These three paths are the ENTIRE runtime payload (~57 MB). Never copy the
|
|
# whole .next/ directory here — .next/dev and .next/cache are build-host-only
|
|
# and account for ~1.96 GB.
|
|
COPY --from=builder --chown=nextjs:nodejs /app/public ./public
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["node", "server.js"]
|