| # ============================================================================= | |
| # World Monitor — Docker Image | |
| # ============================================================================= | |
| # Multi-stage build: | |
| # builder — installs deps, compiles TS handlers, builds Vite frontend | |
| # runtime-deps — installs only packages needed by unbundled raw JS handlers | |
| # final — nginx (static) + node (API) under supervisord | |
| # ============================================================================= | |
| # ── Stage 1: Builder ───────────────────────────────────────────────────────── | |
| FROM node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS builder | |
| WORKDIR /app | |
| # Install root dependencies (layer-cached until package.json changes) | |
| COPY package.json package-lock.json ./ | |
| RUN npm ci --ignore-scripts | |
| # Copy full source | |
| COPY . . | |
| # Compile TypeScript API handlers → self-contained ESM bundles | |
| # Output is api/**/*.js alongside the source .ts files | |
| RUN node docker/build-handlers.mjs | |
| # Build the crawlable static corpus and Vite frontend (outputs to dist/) | |
| # Skip blog build — blog-site has its own deps not installed here | |
| RUN npm run build:crawlable-corpus && npm run build:sitemap && npx tsc && npx vite build | |
| # ── Stage 2: Runtime dependencies ─────────────────────────────────────────── | |
| FROM node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS runtime-deps | |
| WORKDIR /app | |
| # Keep the runtime dependency set deliberately smaller than the app's full | |
| # production graph. The raw api/*.js handlers are not bundled by | |
| # docker/build-handlers.mjs, so they still need these package imports at | |
| # runtime, but the frontend/server-only production deps do not belong in the | |
| # final image. | |
| COPY docker/runtime-package.json ./package.json | |
| COPY docker/runtime-package-lock.json ./package-lock.json | |
| RUN npm ci --omit=dev --omit=optional --ignore-scripts | |
| # ── Stage 3: Runtime ───────────────────────────────────────────────────────── | |
| FROM node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS final | |
| # nginx + supervisord | |
| RUN apk add --no-cache nginx supervisor gettext && \ | |
| mkdir -p /tmp/nginx-client-body /tmp/nginx-proxy /tmp/nginx-fastcgi \ | |
| /tmp/nginx-uwsgi /tmp/nginx-scgi /var/log/supervisor && \ | |
| addgroup -S appgroup && adduser -S appuser -G appgroup | |
| WORKDIR /app | |
| # API server | |
| COPY --from=builder /app/src-tauri/sidecar/local-api-server.mjs ./local-api-server.mjs | |
| COPY --from=builder /app/src-tauri/sidecar/package.json ./package.json | |
| # Minimal runtime node_modules — required by raw .js handlers that aren't | |
| # bundled by build-handlers.mjs. Without this the Node sidecar dispatches | |
| # those routes, fails to resolve package imports like @upstash/ratelimit, | |
| # and returns 502 "missing dependency". | |
| COPY --from=runtime-deps /app/node_modules ./node_modules | |
| # API handler modules (JS originals + compiled TS bundles) | |
| COPY --from=builder /app/api ./api | |
| # Static data files used by handlers at runtime | |
| COPY --from=builder /app/data ./data | |
| # Built frontend static files | |
| COPY --from=builder /app/dist /usr/share/nginx/html | |
| # Nginx + supervisord configs | |
| COPY docker/nginx.conf /etc/nginx/nginx.conf.template | |
| COPY docker/supervisord.conf /etc/supervisor/conf.d/worldmonitor.conf | |
| COPY docker/entrypoint.sh /app/entrypoint.sh | |
| RUN chmod +x /app/entrypoint.sh | |
| # Ensure writable dirs for non-root | |
| RUN chown -R appuser:appgroup /app /tmp/nginx-client-body /tmp/nginx-proxy \ | |
| /tmp/nginx-fastcgi /tmp/nginx-uwsgi /tmp/nginx-scgi /var/log/supervisor \ | |
| /var/lib/nginx /var/log/nginx | |
| USER appuser | |
| EXPOSE 8080 | |
| # Healthcheck via nginx. Use 127.0.0.1 (not localhost - that resolves to ::1 | |
| # first, where nginx does not listen). Probe /api/sidecar-health, a dedicated | |
| # auth-exempt liveness route in the sidecar (local-api-server.mjs): reaching it | |
| # through nginx's /api/ proxy verifies BOTH nginx and the node sidecar are up, | |
| # unlike a static "/" probe which only proves nginx is serving. Keep this off | |
| # /api/health so the public compact data-health contract still reaches api/health.js. | |
| HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \ | |
| CMD wget -qO- http://127.0.0.1:8080/api/sidecar-health >/dev/null 2>&1 || exit 1 | |
| CMD ["/app/entrypoint.sh"] | |