tanshu
e0eb577e3e
Sentry.io integration. Vince integration. Region-scoped consent (denied-by-default in EU/EEA/UK/CH, granted elsewhere, DPDP-friendly notice)
92 lines
3.9 KiB
Docker
92 lines
3.9 KiB
Docker
# ── Mozimo — TanStack Start (Vite) + PocketBase ─────────────
|
|
# Three-stage build:
|
|
# deps — reproducible dependency install (npm ci, cache-mounted)
|
|
# builder — production build (vite build → dist/)
|
|
# runner — lean runtime: production deps + dist + a plain Node server
|
|
# and PocketBase, started together by entrypoint.sh
|
|
#
|
|
# Ports: 3000 = web (SSR), 8090 = PocketBase (cms.<host> → here)
|
|
|
|
ARG NODE_VERSION=26
|
|
|
|
# ── deps ────────────────────────────────────────────────────
|
|
FROM node:${NODE_VERSION}-trixie-slim AS deps
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
RUN --mount=type=cache,target=/root/.npm \
|
|
npm ci --no-audit --no-fund
|
|
|
|
# ── builder ─────────────────────────────────────────────────
|
|
FROM node:${NODE_VERSION}-trixie-slim AS builder
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
|
|
# Analytics ids are baked into the client bundle at build time (Vite
|
|
# statically replaces import.meta.env.VITE_*). The Makefile passes them
|
|
# from the deploy machine's .env — empty values cleanly disable each tool.
|
|
ARG VITE_GA4_MEASUREMENT_ID=""
|
|
ARG VITE_PLAUSIBLE_DOMAIN=""
|
|
ARG VITE_SENTRY_DSN=""
|
|
ARG VITE_SENTRY_RELEASE=""
|
|
ENV VITE_GA4_MEASUREMENT_ID=$VITE_GA4_MEASUREMENT_ID \
|
|
VITE_PLAUSIBLE_DOMAIN=$VITE_PLAUSIBLE_DOMAIN \
|
|
VITE_SENTRY_DSN=$VITE_SENTRY_DSN \
|
|
VITE_SENTRY_RELEASE=$VITE_SENTRY_RELEASE
|
|
|
|
RUN npm run build
|
|
|
|
# ── runner ──────────────────────────────────────────────────
|
|
FROM node:${NODE_VERSION}-trixie-slim AS runner
|
|
LABEL org.opencontainers.image.title="Mozimo" \
|
|
org.opencontainers.image.description="Mozimo — luxury chocolate storefront (TanStack Start + PocketBase headless CMS)"
|
|
WORKDIR /app
|
|
|
|
ARG PB_VERSION=0.40.2
|
|
ARG TARGETARCH
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends unzip ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& case "$TARGETARCH" in \
|
|
arm64) PB_ARCH=arm64 ;; \
|
|
arm) PB_ARCH=arm ;; \
|
|
*) PB_ARCH=amd64 ;; \
|
|
esac \
|
|
&& node -e "const{writeFileSync}=require('fs');fetch('https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${PB_ARCH}.zip').then(r=>{if(!r.ok)throw new Error('download failed: '+r.status);return r.arrayBuffer()}).then(b=>{writeFileSync('/tmp/pb.zip',Buffer.from(b))})" \
|
|
&& unzip -o /tmp/pb.zip pocketbase -d /usr/local/bin/ \
|
|
&& chmod 0755 /usr/local/bin/pocketbase \
|
|
&& rm /tmp/pb.zip \
|
|
&& mkdir -p /app/pb_data \
|
|
&& chown node:node /app/pb_data
|
|
|
|
ENV NODE_ENV=production \
|
|
HOST=0.0.0.0 \
|
|
PORT=3000 \
|
|
PB_PORT=8090 \
|
|
PB_URL=http://127.0.0.1:8090 \
|
|
SHOPIFY_TOKEN_CACHE=/app/pb_data/shopify-token.json
|
|
|
|
# Release id for server-side Sentry (matches the client bundle's baked value).
|
|
ARG SENTRY_RELEASE=""
|
|
ENV SENTRY_RELEASE=$SENTRY_RELEASE
|
|
|
|
# Install production dependencies only (react + @tanstack/* — no vite,
|
|
# tailwind, eslint or typescript ship in the runtime image).
|
|
COPY package.json package-lock.json ./
|
|
RUN --mount=type=cache,target=/root/.npm \
|
|
npm ci --omit=dev --no-audit --no-fund
|
|
|
|
COPY --from=builder --chown=root:root /app/dist ./dist
|
|
COPY --chmod=0644 server.mjs entrypoint.sh scripts/pb-seed.mjs ./
|
|
|
|
# Run as the unprivileged `node` user shipped with the base image.
|
|
USER node
|
|
|
|
EXPOSE 3000 8090
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/',{redirect:'manual'}).then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))"
|
|
|
|
# entrypoint.sh starts PocketBase + the SSR server and forwards signals.
|
|
ENTRYPOINT ["bash", "entrypoint.sh"]
|