Initial commit

apps/server/Dockerfile

@@ -0,0 +1,63 @@
+# syntax=docker/dockerfile:1
+#
+# Build context is the REPO ROOT (see docker/docker-compose.yml and
+# docker/docker-compose.prod.yml: `context: ..`), because this image bundles
+# both apps/server and the built apps/web static assets, plus the shared
+# workspace package.
+
+FROM node:22-alpine AS base
+RUN corepack enable
+# pg_dump — used by modules/admin/backup.ts (Admin > Backups), not just the
+# standalone scripts/backup.sh. Alpine's postgresql-client tracks a recent
+# major version; pg_dump's wire protocol is compatible against our
+# postgres:16-alpine server regardless of exact version match.
+RUN apk add --no-cache postgresql-client
+WORKDIR /workspace
+
+# ---- deps: install workspace dependencies (cached separately from source) ----
+FROM base AS deps
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
+COPY apps/server/package.json apps/server/package.json
+COPY apps/web/package.json apps/web/package.json
+COPY packages/shared/package.json packages/shared/package.json
+# Falls back to a non-frozen install until a pnpm-lock.yaml exists in the
+# repo (run `pnpm install` locally once to generate it, then this can be
+# tightened to `--frozen-lockfile` for reproducible builds).
+RUN pnpm install
+
+# ---- dev: source comes from the docker-compose.yml bind mount at runtime ----
+FROM deps AS dev
+ENV NODE_ENV=development
+EXPOSE 8080 8081
+CMD ["pnpm", "run", "dev"]
+
+# ---- build: compile server + web for the production image ----
+FROM deps AS build
+COPY . .
+RUN pnpm --filter @notizarr/web build
+RUN pnpm --filter @notizarr/server build
+
+# ---- runtime: minimal image, non-root, only what's needed to run ----
+# Deliberately not using `pnpm deploy` here: it's meant for publishable
+# packages and its file-inclusion rules interact awkwardly with dist/ being
+# gitignored. A plain workspace-root `pnpm install --prod` + explicit copies
+# of the two build outputs is more predictable and easy to reason about.
+FROM node:22-alpine AS runtime
+RUN corepack enable
+WORKDIR /app
+ENV NODE_ENV=production
+ENV STATIC_WEB_DIR=/app/apps/web/dist
+RUN addgroup -S notizarr && adduser -S notizarr -G notizarr
+COPY --from=build /workspace/package.json /workspace/pnpm-workspace.yaml /workspace/pnpm-lock.yaml* ./
+COPY --from=build /workspace/apps/server/package.json ./apps/server/package.json
+COPY --from=build /workspace/apps/web/package.json ./apps/web/package.json
+COPY --from=build /workspace/packages/shared/package.json ./packages/shared/package.json
+RUN pnpm install --prod
+COPY --from=build /workspace/apps/server/dist ./apps/server/dist
+COPY --from=build /workspace/apps/web/dist ./apps/web/dist
+COPY --from=build /workspace/apps/server/healthcheck.js ./apps/server/healthcheck.js
+USER notizarr
+EXPOSE 8080 8081
+HEALTHCHECK --interval=15s --timeout=5s --retries=3 --start-period=20s \
+  CMD ["node", "apps/server/healthcheck.js"]
+CMD ["node", "apps/server/dist/index.js"]