thanhnvandClaude Sonnet 4.6
9892e82221
Infrastructure (H3 CI gate, H5 KMS): - Gitea Actions enabled (GITEA__actions__ENABLED=true) - act_runner: Docker-outside-of-Docker for deploy job - Vault Transit RSA-2048 signing keys (casan-audit-key, casan-policy-key) Vault KMS scripts (H5 governance): - .specify/scripts/bash/vault-kms.sh — sign/verify/pubkey/ensure-key - .specify/scripts/bash/sign-audit-head.sh — sign audit chain via Vault - Updated sign-policy-bundle.sh — Vault path + local fallback - Updated security-gate.sh — KMS gate added (PASS=11 FAIL=0) OKR app deployment (port 80/3001): - Dockerfile.backend — node:22-slim (node:sqlite requires Node 22) - Dockerfile.frontend — node:20-alpine build + nginx:alpine runtime - nginx/nginx.conf — React SPA + /api/v1/* proxy to okr-backend:3001 - backend/entrypoint.sh — auto init DB on first run + seed - .dockerignore CI pipeline (.gitea/workflows/ci.yml): - Job 1: Vitest frontend tests (H3) - Job 2: CASAN security gate + Vault KMS signing (H4/H5) - Job 3: Deploy OKR → port 80 (runs on push to main after tests pass) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
56 lines
1.8 KiB
Docker
56 lines
1.8 KiB
Docker
# ─── Stage 1: Build ──────────────────────────────────────────────────────────
|
|
FROM node:22-slim AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update -qq && apt-get install -y -qq openssl python3 && rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY package.json package-lock.json ./
|
|
COPY backend/package.json ./backend/
|
|
COPY frontend/package.json ./frontend/
|
|
COPY backend/prisma ./backend/prisma
|
|
|
|
RUN npm ci
|
|
|
|
COPY backend/src ./backend/src
|
|
COPY backend/tsconfig*.json ./backend/
|
|
|
|
# Generate Prisma client + compile TypeScript
|
|
RUN cd backend && npx prisma generate && npx tsc -p tsconfig.build.json
|
|
|
|
# ─── Stage 2: Runtime ────────────────────────────────────────────────────────
|
|
FROM node:22-slim AS runtime
|
|
|
|
# node:sqlite (setup-sqlite.mjs) requires Node 22 — this image satisfies that.
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update -qq && apt-get install -y -qq openssl && rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY package.json package-lock.json ./
|
|
COPY backend/package.json ./backend/
|
|
COPY frontend/package.json ./frontend/
|
|
COPY backend/prisma ./backend/prisma
|
|
|
|
# All deps (including devDeps) so that tsx (seed) and prisma CLI are available.
|
|
RUN npm ci --ignore-scripts
|
|
|
|
# Generate Prisma client in runtime image (CWD resolves schema at backend/prisma/schema.prisma)
|
|
RUN cd backend && npx prisma generate
|
|
|
|
COPY --from=builder /app/backend/dist ./backend/dist
|
|
COPY backend/scripts ./backend/scripts
|
|
COPY backend/entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
WORKDIR /app/backend
|
|
|
|
VOLUME ["/data"]
|
|
EXPOSE 3001
|
|
|
|
ENV PORT=3001
|
|
ENV DATABASE_URL=file:/data/okr.db
|
|
ENV NODE_ENV=production
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|