RadiantWaveTech/portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete docker build in preparation for app-runner deployment

Browse Source
This commit is contained in:
NeilClack
2026-07-16 22:01:36 -05:00
parent 96eafafbf6
commit 65ae7675ba
11 changed files with 88 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.dockerignore
+8
View File
@@ -0,0 +1,8 @@
node_modules
.svelte-kit
build
.git
.env
.env.*
npm-debug.log*
.DS_Store
.env.example
+4 -1
View File
@@ -1,5 +1,8 @@
DATABASE_URL=
BETTER_AUTH_SECRET=
BETTER_AUTH_URL=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_ID=6
GOOGLE_CLIENT_SECRET=
RESEND_API_KEY=
EMAIL_FROM=
RESEND_TEMPLATE_ID=
Dockerfile
+53
View File
@@ -0,0 +1,53 @@
# --- Build stage ---
FROM node:24-slim AS build
WORKDIR /app
# Placeholder values ONLY so `vite build` doesn't crash on $env/static/*
# imports during the build step. These are NOT the real runtime values —
# App Platform injects the real ones as env vars when the container runs.
ARG DATABASE_URL=postgres://placeholder:placeholder@localhost:5432/placeholder
ARG ORIGIN=http://localhost:3000
ARG BETTER_AUTH_URL=http://localhost:3000
ARG BETTER_AUTH_BASE_URL=http://localhost:3000
ARG BETTER_AUTH_SECRET=placeholder-build-time-secret-not-used-at-runtime
ENV DATABASE_URL=$DATABASE_URL
ENV ORIGIN=$ORIGIN
ENV BETTER_AUTH_URL=$BETTER_AUTH_URL
ENV BETTER_AUTH_BASE_URL=$BETTER_AUTH_BASE_URL
ENV BETTER_AUTH_SECRET=$BETTER_AUTH_SECRET
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
# Drop devDependencies now that the build is done
RUN npm prune --omit=dev
# --- Runtime stage ---
FROM node:24-slim AS runtime
WORKDIR /app
ENV NODE_ENV=production
ENV PORT=3000
# Install the DigitalOcean managed DB CA cert into the system trust store.
# `ca-certificates` provides update-ca-certificates; certs placed in
# /usr/local/share/ca-certificates/ must end in .crt to be picked up.
COPY digital-ocean.crt /usr/local/share/ca-certificates/digital-ocean.crt
RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates \
&& update-ca-certificates \
&& rm -rf /var/lib/apt/lists/*
# Node still doesn't read the system trust store unless --use-system-ca is
# passed explicitly (available on 22.19+/24.6+, but off by default even here).
# NODE_EXTRA_CA_CERTS is simpler and works regardless of Node version.
ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/digital-ocean.crt
COPY --from=build /app/build ./build
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/package.json ./package.json
EXPOSE 3000
CMD ["node", "build/index.js"]
deploy.md
-12
View File
@@ -1,12 +0,0 @@
Initial Setup:
1. Add the portal flake input to Webserver-Infra/flake.nix with a Forgejo access token.
- Does this need to be in just the inputs, or the outputs as well? I'm still very much learning nix and these things get confusing.
2. Add services.portal.enable = true; to Webserver-Infra/configuration.nix
3. Remove the existing users.users.portal and groups because they exist in this flake now
4. Clone the repo on the server, place the .env, build, then run nixos-rebuild switch. This is mainly to start the service, I presume. The build is just so that the service has something to
start.
To update:
1. git pull
2. Apply shell-instance environment variables for placeholder values to then run `npm ci && npm run build && npm ci --omit=dev`
3. Restart the systemctl service (portal.service) to pickup the changes because the service is in charge of the `node build` command.
digitalocean-database.crt → digital-ocean.crt
View File
nixos/module.nix
-81
View File
@@ -1,81 +0,0 @@
{ config, lib, pkgs, ... }:
let
cfg = config.services.portal;
in
{
options.services.portal = {
enable = lib.mkEnableOption "RhemaWave Portal";
directory = lib.mkOption {
type = lib.types.path;
default = "/mnt/volume_nyc3_01/Portal.RhemaWaveTech.com";
description = "Path to the Portal git clone.";
};
envFile = lib.mkOption {
type = lib.types.path;
default = "${cfg.directory}/.env";
defaultText = lib.literalExpression ''"''${cfg.directory}/.env"'';
description = "Path to the .env file containing secrets.";
};
port = lib.mkOption {
type = lib.types.port;
default = 3001;
description = "Port the Portal listens on.";
};
host = lib.mkOption {
type = lib.types.str;
default = "0.0.0.0";
description = "Host address the Portal binds to.";
};
};
config = lib.mkIf cfg.enable {
users.users.portal = {
isSystemUser = true;
group = "portal";
home = cfg.directory;
};
users.groups.portal = { };
systemd.services.portal = {
description = "RhemaWave Portal";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "portal";
Group = "portal";
WorkingDirectory = cfg.directory;
EnvironmentFile = cfg.envFile;
ExecStart = "${pkgs.nodejs_22}/bin/node build";
Restart = "on-failure";
RestartSec = 5;
};
environment = {
HOST = cfg.host;
PORT = toString cfg.port;
DO_CA_CERTIFICATE = "/var/lib/portal/do-ca-certificate.crt";
NODE_ENV = "production";
};
};
security.sudo.extraRules = [
{
users = [ "forgejo-runner" ];
commands = [
{
command = "/run/current-system/sw/bin/systemctl restart portal";
options = [ "NOPASSWD" ];
}
];
}
];
};
}
package-lock.json
Generated
+3
View File
@@ -46,6 +46,9 @@
"vite": "^7.2.6",
"vitest": "^4.0.15",
"vitest-browser-svelte": "^2.0.1"
},
"engines": {
"node": ">=24"
}
},
"node_modules/@better-auth/core": {
package.json
+4 -1
View File
@@ -3,6 +3,9 @@
"private": true,
"version": "0.0.1",
"type": "module",
"engines": {
"node": ">=24"
},
"scripts": {
"dev": "vite dev",
"build": "vite build",
@@ -57,4 +60,4 @@
"dotenv": "^17.2.3",
"pg": "^8.16.3"
}
}
}
src/lib/auth.ts
+5 -3
View File
@@ -3,21 +3,23 @@ import { prismaAdapter } from "better-auth/adapters/prisma";
import { prisma } from "$lib/db";
import { sveltekitCookies } from "better-auth/svelte-kit";
import { getRequestEvent } from "$app/server";
import { env } from "$env/dynamic/private";
export const auth = betterAuth({
baseURL: process.env.BETTER_AUTH_URL,
baseURL: env.BETTER_AUTH_URL,
database: prismaAdapter(prisma, {
provider: "postgresql",
}),
secret: env.BETTER_AUTH_SECRET,
emailAndPassword: {
enabled: true,
},
socialProviders: {
google: {
prompt: "select_account",
clientId: process.env.GOOGLE_CLIENT_ID as string,
clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
clientId: env.GOOGLE_CLIENT_ID as string,
clientSecret: env.GOOGLE_CLIENT_SECRET,
}
},
plugins: [sveltekitCookies(getRequestEvent)],
src/lib/db.ts
+2 -11
View File
@@ -1,23 +1,14 @@
import 'dotenv/config';
import fs from 'fs';
import pg from 'pg';
import { PrismaPg } from '@prisma/adapter-pg';
import { PrismaClient } from '$lib/generated/prisma/client';
import { env } from '$env/dynamic/private';
let _prisma: PrismaClient | undefined;
function getPrisma(): PrismaClient {
if (!_prisma) {
const ca_cert = process.env.DO_CA_CERTIFICATE ?? '';
const pool = new pg.Pool({
connectionString: process.env.DATABASE_URL,
ssl: ca_cert
? {
rejectUnauthorized: true,
ca: fs.readFileSync(ca_cert).toString()
}
: undefined
connectionString: env.DATABASE_URL
});
const adapter = new PrismaPg(pool);
vite.config.ts
+9
View File
@@ -6,6 +6,15 @@ import { sveltekit } from '@sveltejs/kit/vite';
export default defineConfig({
plugins: [tailwindcss(), sveltekit()],
build: {
rollupOptions: {
external: [
'@prisma/client/runtime/query_compiler_bg.postgresql.mjs',
'@prisma/client/runtime/query_compiler_bg.postgresql.wasm-base64.mjs'
]
}
},
test: {
expect: { requireAssertions: true },