Claude Sonnet 5
0fae699018
All checks were successful
CD / Build and push images (push) Successful in 2m2s
CI / Lint, typecheck, test (push) Successful in 1m43s
CI / Auth e2e pack (push) Successful in 1m48s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 8s
CD / Smoke tests against Test (push) Successful in 1m10s
CD / Promote to Int (push) Successful in 10s
Implements the FileStorage abstraction (uploads/<pondId>/<fileId> on the mounted volume), the attachments model, and POST /ponds/:id/files, GET /media/:fileId, DELETE /files/:id. Uploads are validated by sniffing magic bytes rather than trusting the client's Content-Type/filename (catches a renamed .html-as-.png), checked against the max_file_bytes and storage_bytes quotas, and served with nosniff + immutable caching. Closes #27
34 lines
1.4 KiB
Docker
34 lines
1.4 KiB
Docker
# Build context is the repository root (workspace build):
|
|
# docker build -f apps/api/Dockerfile .
|
|
|
|
FROM node:22.15-alpine AS build
|
|
WORKDIR /repo
|
|
RUN npm install -g pnpm@11
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json tsconfig.base.json ./
|
|
COPY packages/shared ./packages/shared
|
|
COPY apps/api ./apps/api
|
|
RUN pnpm install --frozen-lockfile --filter @dorfteich/api... \
|
|
&& pnpm --filter @dorfteich/shared build \
|
|
&& pnpm --filter @dorfteich/api build \
|
|
# Self-contained production bundle (prod deps only, incl. the prisma CLI
|
|
# needed for migrate-on-start) at /out.
|
|
&& pnpm --filter @dorfteich/api deploy --prod --legacy /out \
|
|
&& cp -r apps/api/dist /out/dist
|
|
|
|
FROM node:22.15-alpine
|
|
ARG APP_VERSION=0.0.0-dev
|
|
ENV NODE_ENV=production APP_VERSION=${APP_VERSION}
|
|
WORKDIR /app
|
|
COPY --from=build --chown=node:node /out /app
|
|
# Generate the Prisma client for this image's platform.
|
|
RUN node node_modules/prisma/build/index.js generate
|
|
# A fresh named volume mounted at /data/uploads is created root-owned;
|
|
# pre-creating it here (Docker copies an image directory's ownership into
|
|
# a new volume on first mount) lets the non-root `node` user write to it.
|
|
RUN mkdir -p /data/uploads && chown -R node:node /data/uploads
|
|
USER node
|
|
EXPOSE 3000
|
|
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/v1/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
CMD ["node", "dist/main.js"]
|