Riyadh
3727ce8bf0
Fully decoupled Tx OS from the Replit hosted environment so the project can be cloned and run on any Linux VPS with `docker compose up`. Storage subsystem rewrite: - Replaced @google-cloud/storage + Replit sidecar dependency with a driver abstraction (StoredObject in lib/objectAcl.ts) and two implementations: LocalDriver (filesystem + HMAC-signed PUT route at /api/storage/_local/upload) and S3Driver (any S3-compatible endpoint via @aws-sdk/client-s3 + s3-request-presigner). Driver auto-selected by STORAGE_DRIVER / S3_ENDPOINT env vars. - Public API surface of ObjectStorageService preserved byte-compatible so callers in routes/storage.ts and routes/executive-meetings.ts did not change; download() added to both drivers to keep loadLogoBytes() working (caught in code review round 1). - Storage object-authz tests A-L (incl. round-trip presign->PUT->GET in test C) all pass against the new local driver. Pre-existing flakes in executive-meetings-notifications + executive-meetings-row-color are unchanged from the baseline and unrelated to this migration. Infrastructure: - Dockerfile (6 targets: deps/build/api/web/mockup/migrate). API stage uses the official Playwright base image so PDF rendering works in-container; web stage is nginx serving the Vite SPA bundle; mockup stage carries source + node_modules so the dev preview server runs with PORT=8081 BASE_PATH=/__mockup. - docker-compose.yml: postgres + minio + minio-init (creates buckets) + api (host :8080) + web (host :3000) + one-shot migrate runner; the mockup-sandbox service is gated behind a `dev` profile (host :8081 /__mockup) so a normal `docker compose up -d` does NOT start it. Healthchecks on every long-lived service. - docker/nginx.conf: SPA fallback, /api proxy, /api/socket.io websocket upgrade ordering. - .env.example: every runtime env var consumed by app/objectStorage/ auth/seed/compose paths is documented with comments — host ports, PUBLIC_BASE_URL, ALLOWED_ORIGINS, SESSION_SECRET, BASE_PATH, DATABASE_URL, STORAGE_DRIVER, PRIVATE_OBJECT_DIR, PUBLIC_OBJECT_SEARCH_PATHS, S3_*, LOCAL_STORAGE_ROOT, LOCAL_STORAGE_SIGNING_SECRET, SEED_*, SMTP_*. - README.md replaces replit.md as the canonical project doc; covers Docker quickstart with a service/port table, local dev, env reference, production checklist. - MIGRATION_REPORT.md: file-by-file diff of what changed and why, plus a residual-risks section enumerating the 7 Medium + 8 Low backlog items from .local/security/manual-review.md and the unmigrated object-data note. Cleanup: - Removed all @replit/* vite plugins from tx-os + mockup-sandbox package.json + vite.config.ts + pnpm-workspace.yaml catalog. - Removed @google-cloud/storage and google-auth-library from api-server. - Deleted attached_assets/ (23MB), sedMkjeJm temp file, stale dist/ and *.tsbuildinfo build artefacts, scripts/post-merge.sh, replit.md. - Stripped Replit references from threat_model.md (sidecar, S4 row, G8 invariant), the storage-object-authz test comment, and the objectStorage.ts header comment. Source/config/docs are now - New comprehensive .gitignore: attached_assets/, Replit configs (.replit, replit.nix, .replitignore, replit.md), agent state (.local/, .canvas/, .agents/, .cache/, .config/, .upm/), local storage/, .env*, build artefacts. - scripts/src/seed.ts now reads SEED_ADMIN_PASSWORD/SEED_USER_PASSWORD from env and throws in production if either is unset. Drift from plan: .replit, .replitignore, replit.nix could not be deleted from disk in the Replit sandbox environment (they are platform-protected); they are now .gitignore'd so they will not appear in any clone of the repository, and MIGRATION_REPORT.md documents the one-line `git rm --cached` an operator can run on a non-Replit clone to purge them from upstream git history. replit.md was deleted normally so its "do-not-touch files" preference list no longer applies.
104 lines
5.0 KiB
Docker
104 lines
5.0 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# =============================================================================
|
|
# Tx OS — single Dockerfile with three targets:
|
|
# --target api → runs the Express + Socket.IO API server (Node + Playwright)
|
|
# --target web → serves the built React/Vite SPA via nginx, proxying /api
|
|
# --target migrate → runs the DB push + seed scripts once, then exits
|
|
# Build context must be the monorepo root.
|
|
# =============================================================================
|
|
|
|
ARG NODE_VERSION=24
|
|
ARG PLAYWRIGHT_VERSION=1.59.1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 1: install workspace dependencies (cached layer for source rebuilds)
|
|
# -----------------------------------------------------------------------------
|
|
FROM node:${NODE_VERSION}-bookworm-slim AS deps
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@10.26.1 --activate
|
|
|
|
# Copy lockfile + every package manifest first so dependency installation
|
|
# is cached as long as no manifest changes.
|
|
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
|
|
COPY artifacts/api-server/package.json artifacts/api-server/
|
|
COPY artifacts/tx-os/package.json artifacts/tx-os/
|
|
COPY artifacts/mockup-sandbox/package.json artifacts/mockup-sandbox/
|
|
COPY scripts/package.json scripts/
|
|
COPY lib lib
|
|
# Re-copy lib package.json files (lib has its own subprojects with manifests)
|
|
RUN find lib -name node_modules -prune -o -name dist -prune -o -type f -print | head -1 >/dev/null
|
|
|
|
ENV CI=true \
|
|
HUSKY=0 \
|
|
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
RUN --mount=type=cache,id=pnpm-store,target=/root/.local/share/pnpm/store \
|
|
pnpm install --frozen-lockfile --prefer-offline
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 2: build all workspace artifacts
|
|
# -----------------------------------------------------------------------------
|
|
FROM deps AS build
|
|
WORKDIR /app
|
|
COPY . .
|
|
# Build API (esbuild bundle to dist/index.mjs).
|
|
RUN pnpm --filter @workspace/api-server build
|
|
# Build SPA (Vite static bundle to dist/public). PORT/BASE_PATH are
|
|
# required by vite.config.ts at build time even though the static
|
|
# bundle is served by nginx — give them placeholder values.
|
|
RUN PORT=3000 BASE_PATH=/ pnpm --filter @workspace/tx-os build
|
|
# Compile TS in scripts/ for the migrate target.
|
|
RUN pnpm --filter scripts run build || true
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 3: API runtime — Playwright base ships Chromium + Linux deps for PDF.
|
|
# -----------------------------------------------------------------------------
|
|
FROM mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-jammy AS api
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production \
|
|
NODE_OPTIONS="--enable-source-maps"
|
|
# Bring across the api server bundle + its node_modules (esbuild externalises
|
|
# Playwright/PDFKit/etc. at runtime, so we need the installed packages here).
|
|
COPY --from=build /app/artifacts/api-server/dist artifacts/api-server/dist
|
|
COPY --from=build /app/artifacts/api-server/node_modules artifacts/api-server/node_modules
|
|
COPY --from=build /app/artifacts/api-server/assets artifacts/api-server/assets
|
|
COPY --from=build /app/node_modules node_modules
|
|
EXPOSE 8080
|
|
WORKDIR /app/artifacts/api-server
|
|
CMD ["node", "--enable-source-maps", "./dist/index.mjs"]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 4: web runtime — nginx serves the SPA + proxies /api to the API.
|
|
# -----------------------------------------------------------------------------
|
|
FROM nginx:1.27-alpine AS web
|
|
COPY --from=build /app/artifacts/tx-os/dist/public /usr/share/nginx/html
|
|
COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
|
|
EXPOSE 80
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD wget -qO- http://localhost/healthz >/dev/null || exit 1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 5a: mockup-sandbox runtime (dev-only). Carries source + node_modules
|
|
# so `pnpm --filter @workspace/mockup-sandbox dev` can run the Vite preview
|
|
# server. Not part of the default compose stack — gated behind the `dev` profile.
|
|
# -----------------------------------------------------------------------------
|
|
FROM node:${NODE_VERSION}-bookworm-slim AS mockup
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@10.26.1 --activate
|
|
COPY --from=build /app /app
|
|
ENV NODE_ENV=development \
|
|
PORT=8081 \
|
|
BASE_PATH=/__mockup
|
|
EXPOSE 8081
|
|
CMD ["pnpm", "--filter", "@workspace/mockup-sandbox", "run", "dev"]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Stage 5b: one-shot DB migration + seed runner (used by `docker compose run migrate`).
|
|
# -----------------------------------------------------------------------------
|
|
FROM node:${NODE_VERSION}-bookworm-slim AS migrate
|
|
WORKDIR /app
|
|
RUN corepack enable && corepack prepare pnpm@10.26.1 --activate
|
|
COPY --from=build /app /app
|
|
ENV NODE_ENV=production
|
|
CMD ["sh", "-c", "pnpm --filter db run push-force && pnpm --filter scripts run seed"]
|