Arnaud
adaa837564
Manual: DELETE /api/v1/ai/chat-history (scoped by recipeId or scope=general, matching GET's scoping) plus a trash-icon button + confirm dialog in both chat panels' headers. Automatic: new internal cron endpoint (chat-cleanup), same shared-secret pattern as the existing leftover-reminders/weekly-digest crons, deletes any chat_messages older than 90 days. Wired into cron/crontab (daily, 03:00 UTC) and the Dockerfile's cron stage. Verified locally: cleared a real conversation through the actual UI and confirmed it didn't come back on reopen (not just cleared client-side); inserted a 100-day-old and a 5-day-old message directly, called the cron endpoint with the real shared-secret check, confirmed only the old one was deleted and the recent one survived; confirmed the endpoint 401s with no/wrong secret.
82 lines
3.6 KiB
Docker
82 lines
3.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM node:22-alpine AS base
|
|
RUN corepack enable
|
|
|
|
# ---- deps: install full workspace deps ----
|
|
FROM base AS deps
|
|
WORKDIR /repo
|
|
COPY pnpm-workspace.yaml package.json pnpm-lock.yaml ./
|
|
COPY apps/web/package.json apps/web/package.json
|
|
COPY packages/db/package.json packages/db/package.json
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# ---- migrator: applies drizzle migrations + seeds tier definitions ----
|
|
FROM deps AS migrator
|
|
WORKDIR /repo/packages/db
|
|
COPY packages/db .
|
|
CMD ["sh", "-c", "pnpm migrate && pnpm seed"]
|
|
|
|
# ---- build ----
|
|
FROM base AS build
|
|
WORKDIR /repo
|
|
COPY --from=deps /repo/node_modules ./node_modules
|
|
COPY --from=deps /repo/apps/web/node_modules ./apps/web/node_modules
|
|
COPY --from=deps /repo/packages/db/node_modules ./packages/db/node_modules
|
|
COPY . .
|
|
# apps/web/.env.local is normally a symlink to repo-root .env.local (gitignored);
|
|
# it doesn't exist in the build context, so Next's env loader chokes on the dangling
|
|
# link. No secrets are needed at build time — they're injected at container runtime.
|
|
RUN rm -f apps/web/.env.local && touch apps/web/.env.local
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
# NEXT_PUBLIC_* vars are inlined into the client bundle at build time, not read at
|
|
# container runtime — must be passed as build args (compose.prod.yml wires these
|
|
# from the same stack env vars used at runtime, so they stay in sync).
|
|
ARG NEXT_PUBLIC_VAPID_PUBLIC_KEY
|
|
ARG NEXT_PUBLIC_GITHUB_ENABLED
|
|
ARG NEXT_PUBLIC_DISCORD_ENABLED
|
|
ARG NEXT_PUBLIC_AUTHENTIK_ENABLED
|
|
ENV NEXT_PUBLIC_VAPID_PUBLIC_KEY=$NEXT_PUBLIC_VAPID_PUBLIC_KEY
|
|
ENV NEXT_PUBLIC_GITHUB_ENABLED=$NEXT_PUBLIC_GITHUB_ENABLED
|
|
ENV NEXT_PUBLIC_DISCORD_ENABLED=$NEXT_PUBLIC_DISCORD_ENABLED
|
|
ENV NEXT_PUBLIC_AUTHENTIK_ENABLED=$NEXT_PUBLIC_AUTHENTIK_ENABLED
|
|
# next.config.ts reads STORAGE_PUBLIC_URL to compute the CSP connect-src/img-src
|
|
# allowlist, and next.config.ts's headers() are evaluated at build time — so this
|
|
# also needs to be a build arg, not just a runtime env var (unlike STORAGE_ENDPOINT).
|
|
ARG STORAGE_PUBLIC_URL
|
|
ENV STORAGE_PUBLIC_URL=$STORAGE_PUBLIC_URL
|
|
# lib/storage.ts's getPublicUrl() is called from client components to render photo
|
|
# <img> tags — a plain (non-NEXT_PUBLIC_) env var is never inlined into the browser
|
|
# bundle, so it must be duplicated under a NEXT_PUBLIC_ name to reach the client.
|
|
ARG NEXT_PUBLIC_STORAGE_PUBLIC_URL
|
|
ENV NEXT_PUBLIC_STORAGE_PUBLIC_URL=$NEXT_PUBLIC_STORAGE_PUBLIC_URL
|
|
RUN pnpm --filter web build
|
|
|
|
# ---- runtime ----
|
|
FROM base AS runner
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV PORT=3000
|
|
RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
|
|
|
|
COPY --from=build /repo/apps/web/public ./public
|
|
COPY --from=build --chown=nextjs:nodejs /repo/apps/web/.next/standalone ./
|
|
COPY --from=build --chown=nextjs:nodejs /repo/apps/web/.next/static ./apps/web/.next/static
|
|
|
|
USER nextjs
|
|
EXPOSE 3000
|
|
CMD ["node", "apps/web/server.js"]
|
|
|
|
# ---- cron: periodically triggers internal cron endpoints (e.g. weekly digest) ----
|
|
# Minimal alpine + busybox crond image — just curls the running `web` service on a
|
|
# schedule. Doesn't need the app build output at all, so it's based on `base`
|
|
# rather than `runner`, keeping the image tiny and independent of the Next build.
|
|
FROM base AS cron
|
|
RUN apk add --no-cache curl
|
|
COPY cron/crontab /etc/crontabs/root
|
|
COPY cron/run-digest.sh /usr/local/bin/run-digest.sh
|
|
COPY cron/run-leftover-reminders.sh /usr/local/bin/run-leftover-reminders.sh
|
|
COPY cron/run-chat-cleanup.sh /usr/local/bin/run-chat-cleanup.sh
|
|
RUN chmod +x /usr/local/bin/run-digest.sh /usr/local/bin/run-leftover-reminders.sh /usr/local/bin/run-chat-cleanup.sh
|
|
CMD ["crond", "-f", "-l", "2"]
|