luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(16-01): bake ENV NODE_ENV=production into production Dockerfile stage

Browse Source 
- Add ENV NODE_ENV=production in production stage after WORKDIR /app/apps/api
- Engages the devBypass.ts hard guard so DEV_AUTH_BYPASS can never inject
  DEV_USER in the shipped image, even if accidentally set (D-07)
- No other stage (base/builder/dev/pwa-builder) is affected
This commit is contained in:
Lucas Berger
2026-06-13 05:14:28 -04:00
parent c2ffd1c1b2
commit 5b4f32a649
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/Dockerfile
+4
View File
@@ -39,6 +39,10 @@ COPY apps/pwa/package.json ./apps/pwa/
RUN pnpm install --frozen-lockfile --prod --filter @familysync/api... RUN pnpm install --frozen-lockfile --prod --filter @familysync/api...
COPY --from=builder /app/apps/api/dist ./apps/api/dist COPY --from=builder /app/apps/api/dist ./apps/api/dist
WORKDIR /app/apps/api WORKDIR /app/apps/api
# Enforce production identity — engages the NODE_ENV=production hard guard
# in devBypass.ts, preventing dev-bypass activation even if DEV_AUTH_BYPASS
# is accidentally set in the container environment. (D-07)
ENV NODE_ENV=production
# PWA static assets built from apps/pwa and served by this API from ./public # PWA static assets built from apps/pwa and served by this API from ./public
# (single-port deployment for the Pangolin/newt tunnel). serveStatic resolves # (single-port deployment for the Pangolin/newt tunnel). serveStatic resolves
# ./public relative to the runtime CWD, which is this WORKDIR (/app/apps/api). # ./public relative to the runtime CWD, which is this WORKDIR (/app/apps/api).