feat(deploy): dockerize web app for portainer git-stack deploy behind external traefik

Add root Dockerfile (standalone Next output, multi-stage pnpm build), drop
in-stack caddy in favor of publishing web's port for an external traefik
LXC (file-provider dynamic config included), and document the portainer
deploy flow.

Also fixes issues that blocked any production build: a bad auth-client
type cast, the ai SDK's mimeType->mediaType rename, an implicit-any
callback param, and push.ts eagerly calling webpush.setVapidDetails at
module import time (which crashed page-data collection whenever VAPID
env vars weren't present at build) — now lazily configured on first send.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker/Caddyfile

@@ -1,3 +0,0 @@
-{$DOMAIN} {
-  reverse_proxy web:3000
-}

docker/DEPLOY.md

@@ -0,0 +1,51 @@
+# Deploy: Portainer (git stack) + external Traefik LXC
+
+## Portainer
+
+1. Stacks → Add stack → **Repository**
+2. Repository URL: this repo. Reference: branch to track (e.g. `main`)
+3. Compose path: `docker/compose.prod.yml`
+4. Environment variables (Portainer stack env, not committed):
+
+```
+POSTGRES_DB=epicure
+POSTGRES_USER=epicure
+POSTGRES_PASSWORD=<generate>
+REDIS_PASSWORD=<generate>
+MINIO_ROOT_USER=<generate>
+MINIO_ROOT_PASSWORD=<generate>
+BETTER_AUTH_SECRET=<openssl rand -base64 32>
+BETTER_AUTH_URL=https://HOST_DOMAIN
+ENCRYPTION_SECRET=<openssl rand -base64 32>
+NEXT_PUBLIC_VAPID_PUBLIC_KEY=<npx web-push generate-vapid-keys>
+VAPID_PRIVATE_KEY=<from same command>
+WEB_PORT=3000
+# optional
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+OPENROUTER_API_KEY=
+```
+
+5. Deploy the stack. Portainer builds `web` from the repo's root `Dockerfile` (see `build:` in compose.prod.yml) — no separate image push needed.
+6. Enable GitOps updates (webhook or polling) on the stack if you want redeploy-on-push.
+
+## First deploy: run migrations + seed
+
+Compose does not auto-migrate. After the stack is up, exec into the `web` container once (or run a one-off container against the same network) with `DATABASE_URL` set, then:
+
+```bash
+pnpm db:migrate
+pnpm db:seed   # tier definitions — first deploy only
+```
+
+## Traefik (separate LXC, file provider)
+
+1. Copy `docker/traefik/epicure.yml` into the traefik LXC's dynamic config directory.
+2. Replace `HOST_DOMAIN` with the public hostname and `PORTAINER_LXC_IP` with the portainer LXC's network IP (must match `WEB_PORT` published in compose.prod.yml).
+3. Confirm `certResolver` name matches what's set in traefik's static config.
+4. Traefik picks it up automatically (file provider watches for changes) — no restart needed.
+
+## Notes
+
+- `web` connects to `postgres`/`redis`/`minio` over the compose-internal network; only `web`'s port is published to the LXC host for traefik to reach.
+- `apps/web/next.config.ts` has `output: "standalone"` — required for the Dockerfile's slim runtime stage.

docker/compose.prod.yml

@@ -30,9 +30,29 @@ services:
     volumes:
       - minio_data:/data
     command: server /data --console-address ":9001"
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  minio-init:
+    image: minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: >
+      /bin/sh -c "
+        mc alias set local http://minio:9000 ${MINIO_ROOT_USER} ${MINIO_ROOT_PASSWORD};
+        mc mb --ignore-existing local/epicure-uploads;
+        mc anonymous set download local/epicure-uploads;
+        exit 0;
+      "
 
   web:
-    image: epicure-web:latest
+    build:
+      context: ..
+      dockerfile: Dockerfile
     restart: always
     environment:
       DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
@@ -43,35 +63,24 @@ services:
       STORAGE_BUCKET: epicure-uploads
       BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
       BETTER_AUTH_URL: ${BETTER_AUTH_URL}
+      ENCRYPTION_SECRET: ${ENCRYPTION_SECRET}
+      NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${NEXT_PUBLIC_VAPID_PUBLIC_KEY}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
     ports:
-      - "3000:3000"
+      # published on portainer LXC host; traefik (other LXC) routes here via <this-lxc-ip>:${WEB_PORT}
+      - "${WEB_PORT:-3000}:3000"
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_started
       minio:
-        condition: service_started
-
-  caddy:
-    image: caddy:2-alpine
-    restart: always
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
-      - caddy_data:/data
-      - caddy_config:/config
-    depends_on:
-      - web
+        condition: service_healthy
 
 volumes:
   postgres_data:
   redis_data:
   minio_data:
-  caddy_data:
-  caddy_config:

docker/traefik/epicure.yml

@@ -0,0 +1,24 @@
+# Traefik file-provider dynamic config.
+# Copy to traefik LXC's dynamic config dir (the one referenced by
+# providers.file.directory in traefik's static config), then edit
+# HOST_DOMAIN and PORTAINER_LXC_IP below.
+
+http:
+  routers:
+    epicure:
+      rule: "Host(`HOST_DOMAIN`)"
+      entryPoints:
+        - websecure
+      service: epicure
+      tls:
+        certResolver: letsencrypt # match whatever resolver name is set in your traefik static config
+
+  services:
+    epicure:
+      loadBalancer:
+        servers:
+          - url: "http://PORTAINER_LXC_IP:3000" # match WEB_PORT from docker/compose.prod.yml env
+        healthCheck:
+          path: /
+          interval: 10s
+          timeout: 3s