Add production Docker deployment configuration

- Add multi-stage Dockerfile for Next.js standalone build
- Add docker-compose.deploy.yml for production deployment
- Add entrypoint.sh for database migration and startup
- Add .dockerignore for efficient Docker builds
- Add docker/.env.production with all required env vars
- Add Caddyfile.prod with security headers and optimizations
- Update next.config.ts with output: standalone for Docker
- Add DOCKER_DEPLOYMENT.md with comprehensive deployment guide

.dockerignore

@@ -0,0 +1,15 @@
+.git
+.gitignore
+README.md
+.env.local
+.env.*.local
+node_modules
+npm-debug.log
+coverage
+.turbo
+.next
+dist
+.DS_Store
+.vscode
+.idea
+*.log

DOCKER_DEPLOYMENT.md

@@ -0,0 +1,221 @@
+# Docker Deployment Guide
+
+This guide explains how to deploy the Epicure application using Docker and Docker Compose.
+
+## Prerequisites
+
+- Docker Engine 20.10+
+- Docker Compose 2.0+
+- At least 2GB RAM available
+- A domain name (for production)
+
+## Quick Start - Development
+
+For local development, use the existing compose setup:
+
+```bash
+docker compose -f docker/compose.yml up -d
+pnpm install
+pnpm db:migrate
+pnpm db:seed
+pnpm dev
+```
+
+Access the app at `http://localhost:3000`
+MinIO console: `http://localhost:9001` (minioadmin / minioadmin)
+
+## Production Deployment
+
+### 1. Prepare Environment
+
+Copy and configure the production environment file:
+
+```bash
+cp docker/.env.production .env.production
+```
+
+Edit `.env.production` and set:
+- `POSTGRES_PASSWORD` - Strong random password
+- `REDIS_PASSWORD` - Strong random password
+- `MINIO_ROOT_PASSWORD` - Strong random password
+- `BETTER_AUTH_SECRET` - Generate: `openssl rand -base64 32`
+- `BETTER_AUTH_URL` - Your domain (e.g., `https://example.com`)
+- `DOMAIN` - Your domain name
+- `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` - OAuth credentials
+- `OPENROUTER_API_KEY` - AI provider key
+- `SMTP_*` - Email configuration
+
+### 2. Build Docker Image
+
+```bash
+docker build -f Dockerfile -t epicure-web:latest .
+```
+
+Or let Docker Compose build it automatically.
+
+### 3. Deploy with Docker Compose
+
+```bash
+docker compose -f docker/docker-compose.deploy.yml --env-file .env.production up -d
+```
+
+### 4. Verify Deployment
+
+```bash
+# Check all services are running
+docker compose -f docker/docker-compose.deploy.yml ps
+
+# Check application logs
+docker compose -f docker/docker-compose.deploy.yml logs -f web
+
+# Verify database migration ran
+docker compose -f docker/docker-compose.deploy.yml logs web | grep -i migration
+```
+
+### 5. Access the Application
+
+- Main app: `https://your-domain.com`
+- MinIO console (if exposed): `https://minio.your-domain.com`
+
+## Production Configuration
+
+### Caddy Configuration
+
+Edit `docker/Caddyfile.prod` to customize:
+- SSL/TLS settings
+- Security headers
+- Compression
+- Rate limiting
+
+### Database Backups
+
+To backup PostgreSQL:
+
+```bash
+docker compose -f docker/docker-compose.deploy.yml exec postgres pg_dump -U epicure epicure > backup.sql
+```
+
+To restore:
+
+```bash
+docker compose -f docker/docker-compose.deploy.yml exec -T postgres psql -U epicure epicure < backup.sql
+```
+
+### MinIO Backups
+
+MinIO data is stored in the `minio_data` volume. Backup the volume:
+
+```bash
+docker run --rm -v epicure_minio_data:/data -v $(pwd):/backup alpine tar czf /backup/minio-backup.tar.gz -C /data .
+```
+
+## Maintenance
+
+### View Logs
+
+```bash
+# All services
+docker compose -f docker/docker-compose.deploy.yml logs -f
+
+# Specific service
+docker compose -f docker/docker-compose.deploy.yml logs -f web
+docker compose -f docker/docker-compose.deploy.yml logs -f postgres
+```
+
+### Database Migrations
+
+To run additional migrations:
+
+```bash
+docker compose -f docker/docker-compose.deploy.yml exec web pnpm db:migrate
+```
+
+### Update Application
+
+1. Build new image:
+```bash
+docker build -f Dockerfile -t epicure-web:latest .
+```
+
+2. Restart service:
+```bash
+docker compose -f docker/docker-compose.deploy.yml up -d web
+```
+
+### Clean Up
+
+Remove all containers and volumes:
+
+```bash
+docker compose -f docker/docker-compose.deploy.yml down -v
+```
+
+## Security Considerations
+
+1. **Passwords**: Use strong, random passwords (minimum 32 characters)
+2. **Environment Variables**: Never commit `.env.production` to git
+3. **TLS/SSL**: Caddy automatically handles Let's Encrypt certificates
+4. **Firewall**: Only expose ports 80 and 443 in production
+5. **Updates**: Regularly update Docker images:
+   ```bash
+   docker compose -f docker/docker-compose.deploy.yml pull
+   docker compose -f docker/docker-compose.deploy.yml up -d
+   ```
+6. **MinIO**: Change default credentials and optionally disable console in production
+
+## Troubleshooting
+
+### Application won't start
+
+Check logs:
+```bash
+docker compose -f docker/docker-compose.deploy.yml logs web
+```
+
+Common issues:
+- Database connection: Ensure `POSTGRES_PASSWORD` matches
+- Redis connection: Verify `REDIS_PASSWORD` is set
+- Storage connection: Check MinIO credentials and bucket exists
+
+### Database migration failed
+
+```bash
+# Check database status
+docker compose -f docker/docker-compose.deploy.yml exec postgres psql -U epicure -d epicure -c "\d"
+
+# Run migrations manually
+docker compose -f docker/docker-compose.deploy.yml exec web pnpm db:migrate
+```
+
+### MinIO initialization failed
+
+```bash
+# Check MinIO logs
+docker compose -f docker/docker-compose.deploy.yml logs minio
+
+# Reinitialize bucket
+docker compose -f docker/docker-compose.deploy.yml restart minio-init
+```
+
+### Performance issues
+
+- Increase RAM: Edit `docker-compose.deploy.yml` and add `mem_limit`
+- Check logs for slow queries
+- Scale PostgreSQL: Consider managed database service for production
+
+## Advanced: Kubernetes Deployment
+
+For Kubernetes, convert this Docker Compose stack:
+
+```bash
+kompose convert -f docker/docker-compose.deploy.yml -o k8s/
+```
+
+This generates Kubernetes manifests ready for deployment to EKS, AKS, or GKE.
+
+## Support
+
+For issues or questions, check:
+- Application logs: `docker compose logs`
+- Service health: `docker compose ps`
+- Database status: `docker compose exec postgres pg_isready`

Dockerfile

@@ -0,0 +1,57 @@
+# Multi-stage build for Next.js monorepo
+FROM node:22-alpine AS base
+RUN corepack enable pnpm
+WORKDIR /app
+
+# Install dependencies stage
+FROM base AS deps
+RUN apk add --no-cache libc6-compat
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+RUN pnpm install --frozen-lockfile --prod
+
+# Build stage
+FROM base AS builder
+RUN apk add --no-cache libc6-compat postgresql-client
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+RUN pnpm install --frozen-lockfile
+
+# Copy source code
+COPY . .
+
+# Build the app
+RUN pnpm build
+
+# Production runtime
+FROM base AS runtime
+RUN apk add --no-cache libc6-compat postgresql-client
+ENV NODE_ENV production
+
+# Copy production node_modules
+COPY --from=deps /app/node_modules ./node_modules
+
+# Copy built Next.js app
+COPY --from=builder /app/apps/web/.next/standalone ./
+
+# Copy public assets
+COPY --from=builder /app/apps/web/public ./public
+
+# Copy workspace packages (needed for migrations)
+COPY --from=builder /app/packages ./packages
+
+# Copy root package.json for pnpm monorepo
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
+
+# Create non-root user
+RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
+
+# Copy entrypoint script
+COPY docker/entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+USER nextjs
+
+EXPOSE 3000
+
+ENV PORT 3000
+
+CMD ["/app/entrypoint.sh"]

apps/web/next.config.ts

@@ -42,6 +42,7 @@ const securityHeaders = [
 ];
 
 const nextConfig: NextConfig = {
+  output: 'standalone',
   async headers() {
     return [
       {

docker/Caddyfile.prod

@@ -0,0 +1,22 @@
+{$DOMAIN} {
+  reverse_proxy web:3000 {
+    header_up Host {host}
+    header_up X-Real-IP {remote_host}
+    header_up X-Forwarded-For {remote_host}
+    header_up X-Forwarded-Proto {scheme}
+  }
+
+  # Compression
+  encode gzip
+
+  # Security headers
+  header X-Content-Type-Options nosniff
+  header X-Frame-Options SAMEORIGIN
+  header X-XSS-Protection "1; mode=block"
+  header Referrer-Policy strict-origin-when-cross-origin
+}
+
+# MinIO console (optional - remove in production for security)
+# minio.{$DOMAIN} {
+#   reverse_proxy minio:9001
+# }

docker/docker-compose.deploy.yml

@@ -0,0 +1,135 @@
+version: '3.8'
+
+services:
+  postgres:
+    image: postgres:17-alpine
+    restart: always
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-epicure}
+      POSTGRES_USER: ${POSTGRES_USER:-epicure}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-epicure}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - epicure
+
+  redis:
+    image: redis:7-alpine
+    restart: always
+    command: redis-server --requirepass ${REDIS_PASSWORD:-changeme}
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - epicure
+
+  minio:
+    image: minio/minio:latest
+    restart: always
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-changeme}
+    volumes:
+      - minio_data:/data
+    command: server /data --console-address ":9001"
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - epicure
+
+  minio-init:
+    image: minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: >
+      /bin/sh -c "
+        mc alias set local http://minio:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-changeme};
+        mc mb --ignore-existing local/epicure-uploads;
+        mc anonymous set download local/epicure-uploads;
+        exit 0;
+      "
+    networks:
+      - epicure
+
+  web:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: always
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER:-epicure}:${POSTGRES_PASSWORD:-changeme}@postgres:5432/${POSTGRES_DB:-epicure}
+      REDIS_URL: redis://:${REDIS_PASSWORD:-changeme}@redis:6379
+      STORAGE_ENDPOINT: http://minio:9000
+      STORAGE_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
+      STORAGE_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-changeme}
+      STORAGE_BUCKET: epicure-uploads
+      STORAGE_REGION: us-east-1
+      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
+      BETTER_AUTH_URL: ${BETTER_AUTH_URL}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
+      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
+      OPENROUTER_DEFAULT_MODEL: ${OPENROUTER_DEFAULT_MODEL:-nvidia/nemotron-3-ultra-550b-a55b:free}
+      SMTP_HOST: ${SMTP_HOST}
+      SMTP_PORT: ${SMTP_PORT}
+      SMTP_SECURE: ${SMTP_SECURE:-false}
+      SMTP_USER: ${SMTP_USER}
+      SMTP_PASS: ${SMTP_PASS}
+      SMTP_FROM: ${SMTP_FROM}
+      NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${NEXT_PUBLIC_VAPID_PUBLIC_KEY}
+      NODE_ENV: production
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      minio:
+        condition: service_healthy
+    networks:
+      - epicure
+
+  caddy:
+    image: caddy:2-alpine
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - caddy_data:/data
+      - caddy_config:/config
+    environment:
+      DOMAIN: ${DOMAIN:-localhost}
+    depends_on:
+      - web
+    networks:
+      - epicure
+
+volumes:
+  postgres_data:
+    driver: local
+  redis_data:
+    driver: local
+  minio_data:
+    driver: local
+  caddy_data:
+    driver: local
+  caddy_config:
+    driver: local
+
+networks:
+  epicure:
+    driver: bridge

docker/entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+# Wait for database to be ready
+until pg_isready -h "${DB_HOST:-postgres}" -U "${POSTGRES_USER:-epicure}" -d "${POSTGRES_DB:-epicure}"; do
+  echo "Waiting for PostgreSQL to be ready..."
+  sleep 2
+done
+
+echo "PostgreSQL is ready!"
+
+# Run migrations
+echo "Running database migrations..."
+cd /app/apps/web
+pnpm db:migrate || true
+
+echo "Starting application..."
+exec node /app/apps/web/.next/standalone/server.js