Denozordec
8d8bddb454
- .turbo в actions/cache (пересборки shared/db переиспользуются между прогонами) - typecheck в web/api джобах, lint бэкенда в api-джобе - убран пустой turbo test --filter=web (в web нет тестов) - timeout-minutes на все джобы - Dockerfile: USER node + --chown; прекомпрессия статики gzip+brotli на этапе сборки (Traefik не сжимает); compose: chown 1000:1000 data в инструкции
59 lines
2.5 KiB
Docker
59 lines
2.5 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
# All-in-one Auth Portal (Fastify + SPA + SQLite). Analog cfdm / evofw.
|
|
ARG BASE_NODE=docker.io/library/node:22-alpine
|
|
|
|
FROM ${BASE_NODE} AS deps
|
|
WORKDIR /repo
|
|
RUN apk add --no-cache python3 make g++ \
|
|
&& corepack enable && corepack prepare [email protected] --activate
|
|
COPY package.json pnpm-workspace.yaml pnpm-lock.yaml turbo.json ./
|
|
COPY apps/web/package.json apps/web/
|
|
COPY apps/api/package.json apps/api/
|
|
COPY packages/ui/package.json packages/ui/
|
|
COPY packages/shared/package.json packages/shared/
|
|
COPY packages/db/package.json packages/db/
|
|
RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
|
|
pnpm install --frozen-lockfile
|
|
|
|
FROM deps AS build
|
|
RUN apk add --no-cache brotli
|
|
COPY apps/web apps/web
|
|
COPY apps/api apps/api
|
|
COPY packages/ui packages/ui
|
|
COPY packages/shared packages/shared
|
|
COPY packages/db packages/db
|
|
RUN --mount=type=cache,target=/root/.local/share/pnpm/store,sharing=locked \
|
|
pnpm turbo build --filter=web --filter=@authportal/api \
|
|
&& pnpm --filter @authportal/api deploy --prod /out \
|
|
&& cp -r apps/web/dist /out/static \
|
|
&& find /out/static -type f \( -name '*.js' -o -name '*.css' \) -exec sh -c \
|
|
'gzip -k9 "$1" && brotli -f -q 11 -o "$1.br" "$1"' _ {} \; \
|
|
&& rm -rf /out/src /out/test /out/.turbo \
|
|
&& rm -rf /out/node_modules/@authportal/db/src /out/node_modules/@authportal/db/scripts /out/node_modules/@authportal/db/.turbo \
|
|
&& rm -rf /out/node_modules/@authportal/shared/src /out/node_modules/@authportal/shared/.turbo \
|
|
&& find /out/dist /out/node_modules/@authportal -type f \( -name '*.d.ts' -o -name '*.map' -o -name 'tsconfig*.json' -o -name 'vitest.config.ts' -o -name 'drizzle.config.ts' \) -delete
|
|
|
|
FROM ${BASE_NODE} AS runtime
|
|
WORKDIR /app
|
|
# Не-root runtime; /data — bind mount с хоста, на сервере нужен
|
|
# `chown -R 1000:1000 ./data` (см. deploy/docker-compose.traefik.yml).
|
|
RUN apk add --no-cache ca-certificates \
|
|
&& mkdir -p /data && chown node:node /data
|
|
ARG VERSION=dev
|
|
ARG GIT_SHA=unknown
|
|
ARG BUILD_TIME=
|
|
ENV NODE_ENV=production \
|
|
STATIC_DIR=/app/static \
|
|
DATABASE_URL=sqlite:/data/app.db \
|
|
SERVER_PORT=8080 \
|
|
APP_VERSION=${VERSION} \
|
|
GIT_SHA=${GIT_SHA} \
|
|
BUILD_TIME=${BUILD_TIME}
|
|
COPY --from=build --chown=node:node /out ./
|
|
USER node
|
|
EXPOSE 8080
|
|
VOLUME ["/data"]
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD ["node", "-e", "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
CMD ["node", "dist/server.js"]
|