riyadhafraa
143ad9a29d
Fully decoupled Tx OS from the Replit hosted environment so the project can be cloned and run on any Linux VPS with `docker compose up`. Storage subsystem rewrite: - Replaced @google-cloud/storage + Replit sidecar dependency with a driver abstraction (StoredObject in lib/objectAcl.ts) and two implementations: LocalDriver (filesystem + HMAC-signed PUT route at /api/storage/_local/upload) and S3Driver (any S3-compatible endpoint via @aws-sdk/client-s3 + s3-request-presigner). Driver auto-selected by STORAGE_DRIVER / S3_ENDPOINT env vars. - Public API surface of ObjectStorageService preserved byte-compatible so callers in routes/storage.ts and routes/executive-meetings.ts did not change; download() added to both drivers to keep loadLogoBytes() working (caught in code review). - Storage object-authz tests A-L (incl. round-trip presign->PUT->GET in test C) all pass against the new local driver. Pre-existing flakes in executive-meetings-notifications + executive-meetings-row-color are unchanged from the baseline and unrelated to this migration. Infrastructure: - Dockerfile (5 targets: deps/build/api/web/migrate). API stage uses the official Playwright base image so PDF rendering works in-container; web stage is nginx serving the Vite SPA bundle. - docker-compose.yml: postgres + minio + minio-init (creates buckets) + api + web + one-shot migrate runner. Healthchecks on every long-lived service. - docker/nginx.conf: SPA fallback, /api proxy, /api/socket.io websocket upgrade ordering. - .env.example: every runtime env var documented with comments. - README.md replaces replit.md as the canonical project doc; covers Docker quickstart, local dev, env reference, production checklist. - MIGRATION_REPORT.md: file-by-file diff of what changed and why. Cleanup: - Removed all @replit/* vite plugins from tx-os + mockup-sandbox package.json + vite.config.ts + pnpm-workspace.yaml catalog. - Removed @google-cloud/storage and google-auth-library from api-server. - Deleted attached_assets/ (23MB), sedMkjeJm temp file, stale dist/ and *.tsbuildinfo build artefacts, scripts/post-merge.sh. - Stripped Replit references from threat_model.md (now describes the self-hosted topology). - New comprehensive .gitignore: Replit configs (.replit, replit.nix, replit.md), agent state (.local/, .canvas/, .agents/, .cache/, .config/, .upm/), local storage/, .env*, build artefacts. .replit and replit.nix remain on disk (sandbox-protected) but will not ship to GitHub. - scripts/src/seed.ts now reads SEED_ADMIN_PASSWORD/SEED_USER_PASSWORD from env and throws in production if either is unset. Drift from plan: replit.md was deleted (per off-Replit scope) so its "do-not-touch files" preference list is moot. .replit/replit.nix kept on disk only because they are sandbox-protected from edit/delete in this environment, but they are git-ignored so they will not appear in a fresh clone.
89 lines
4.3 KiB
Docker
89 lines
4.3 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# =============================================================================
|
|
# Tx OS — single Dockerfile with three targets:
|
|
# --target api → runs the Express + Socket.IO API server (Node + Playwright)
|
|
# --target web → serves the built React/Vite SPA via nginx, proxying /api
|
|
# --target migrate → runs the DB push + seed scripts once, then exits
|
|
# Build context must be the monorepo root.
|
|
# =============================================================================
|
|
|
|
ARG NODE_VERSION=24
|
|
ARG PLAYWRIGHT_VERSION=1.59.1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 1: install workspace dependencies (cached layer for source rebuilds)
|
|
# -----------------------------------------------------------------------------
|
|
FROM node:${NODE_VERSION}-bookworm-slim AS deps
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@10.26.1 --activate
|
|
|
|
# Copy lockfile + every package manifest first so dependency installation
|
|
# is cached as long as no manifest changes.
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
|
|
COPY artifacts/api-server/package.json artifacts/api-server/
|
|
COPY artifacts/tx-os/package.json artifacts/tx-os/
|
|
COPY artifacts/mockup-sandbox/package.json artifacts/mockup-sandbox/
|
|
COPY scripts/package.json scripts/
|
|
COPY lib lib
|
|
# Re-copy lib package.json files (lib has its own subprojects with manifests)
|
|
RUN find lib -name node_modules -prune -o -name dist -prune -o -type f -print | head -1 >/dev/null
|
|
|
|
ENV CI=true \
|
|
HUSKY=0 \
|
|
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
|
|
pnpm install --frozen-lockfile --prefer-offline
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 2: build all workspace artifacts
|
|
# -----------------------------------------------------------------------------
|
|
FROM deps AS build
|
|
WORKDIR /app
|
|
COPY . .
|
|
# Build API (esbuild bundle to dist/index.mjs).
|
|
RUN pnpm --filter @workspace/api-server build
|
|
# Build SPA (Vite static bundle to dist/public). PORT/BASE_PATH are
|
|
# required by vite.config.ts at build time even though the static
|
|
# bundle is served by nginx — give them placeholder values.
|
|
RUN PORT=3000 BASE_PATH=/ pnpm --filter @workspace/tx-os build
|
|
# Compile TS in scripts/ for the migrate target.
|
|
RUN pnpm --filter scripts run build || true
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 3: API runtime — Playwright base ships Chromium + Linux deps for PDF.
|
|
# -----------------------------------------------------------------------------
|
|
FROM mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-jammy AS api
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production \
|
|
NODE_OPTIONS="--enable-source-maps"
|
|
# Bring across the api server bundle + its node_modules (esbuild externalises
|
|
# Playwright/PDFKit/etc. at runtime, so we need the installed packages here).
|
|
COPY --from=build /app/artifacts/api-server/dist artifacts/api-server/dist
|
|
COPY --from=build /app/artifacts/api-server/node_modules artifacts/api-server/node_modules
|
|
COPY --from=build /app/artifacts/api-server/assets artifacts/api-server/assets
|
|
COPY --from=build /app/node_modules node_modules
|
|
EXPOSE 8080
|
|
WORKDIR /app/artifacts/api-server
|
|
CMD ["node", "--enable-source-maps", "./dist/index.mjs"]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 4: web runtime — nginx serves the SPA + proxies /api to the API.
|
|
# -----------------------------------------------------------------------------
|
|
FROM nginx:1.27-alpine AS web
|
|
COPY --from=build /app/artifacts/tx-os/dist/public /usr/share/nginx/html
|
|
COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
|
|
EXPOSE 80
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD wget -qO- http://localhost/healthz >/dev/null || exit 1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 5: one-shot DB migration + seed runner (used by `docker compose run migrate`).
|
|
# -----------------------------------------------------------------------------
|
|
FROM node:${NODE_VERSION}-bookworm-slim AS migrate
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@10.26.1 --activate
|
|
COPY --from=build /app /app
|
|
ENV NODE_ENV=production
|
|
CMD ["sh", "-c", "pnpm --filter db run push-force && pnpm --filter scripts run seed"]
|