BizzleBot
47c35c1e3a
- Remove JWT secret fallbacks (fail on startup if missing) - Hash refresh tokens with SHA-256 before DB storage - Add Zod validation to bulk-approve, bulk-reject, update-user, copy-week - Add global API rate limiting (100 req/15min per IP) - Fix nginx X-XSS-Protection header (align with Helmet) - Remove --accept-data-loss from Dockerfile CMD - Create .gitignore to protect secrets from commits - Secure .env file permissions (chmod 600)
59 lines
1.9 KiB
Docker
59 lines
1.9 KiB
Docker
# ───────────────────────────────────────────────────
|
|
# Coastal Timesheet — Backend Dockerfile
|
|
# Node 22 Alpine · Prisma · Express
|
|
# ───────────────────────────────────────────────────
|
|
|
|
# ── Stage 1: Install dependencies ──────────────────
|
|
FROM node:22-alpine AS deps
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy package files
|
|
COPY backend/package.json backend/package-lock.json* ./
|
|
|
|
# Install production dependencies
|
|
RUN npm ci --omit=dev 2>/dev/null || npm install --omit=dev
|
|
|
|
# ── Stage 2: Build (generate Prisma client) ────────
|
|
FROM node:22-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy deps from previous stage
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY backend/ ./
|
|
|
|
# Generate Prisma client
|
|
RUN npx prisma generate
|
|
|
|
# ── Stage 3: Production image ─────────────────────
|
|
FROM node:22-alpine AS runner
|
|
|
|
WORKDIR /app
|
|
|
|
# Add non-root user for security
|
|
RUN addgroup --system --gid 1001 coastal && \
|
|
adduser --system --uid 1001 coastal
|
|
|
|
# Copy application
|
|
COPY --from=builder /app/node_modules ./node_modules
|
|
COPY --from=builder /app/prisma ./prisma
|
|
COPY --from=builder /app/src ./src
|
|
COPY --from=builder /app/package.json ./
|
|
|
|
# Fix ownership so non-root user can regenerate Prisma client
|
|
RUN chown -R coastal:coastal /app
|
|
|
|
# Switch to non-root user
|
|
USER coastal
|
|
|
|
# Expose port
|
|
EXPOSE 3001
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD node -e "fetch('http://localhost:3001/api/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"
|
|
|
|
# Start with migration and seed on first run
|
|
CMD ["sh", "-c", "npx prisma db push 2>/dev/null; node prisma/seed.js 2>/dev/null; node src/index.js"]
|