be3e69c10b
- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy on all responses - Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403 - CI: Gitleaks secret scanning + pnpm audit for vulnerabilities - Dependabot: Weekly npm + GitHub Actions + monthly Docker updates - Docker: Non-root user in journal, planner, and brouter containers - Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned) - SECURITY.md: Vulnerability disclosure policy - Privacy page: Security practices section added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
37 lines
1.3 KiB
Docker
37 lines
1.3 KiB
Docker
FROM node:24-slim AS base
|
|
RUN corepack enable && corepack prepare pnpm@10.6.5 --activate
|
|
WORKDIR /app
|
|
|
|
FROM base AS deps
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY apps/planner/package.json apps/planner/
|
|
COPY packages/types/package.json packages/types/
|
|
COPY packages/ui/package.json packages/ui/
|
|
COPY packages/map/package.json packages/map/
|
|
COPY packages/gpx/package.json packages/gpx/
|
|
COPY packages/i18n/package.json packages/i18n/
|
|
COPY packages/db/package.json packages/db/
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
FROM base AS build
|
|
ARG SENTRY_AUTH_TOKEN
|
|
ARG SENTRY_RELEASE
|
|
COPY --from=deps /app/ ./
|
|
COPY . .
|
|
RUN pnpm --filter @trails-cool/planner build
|
|
|
|
FROM base AS runtime
|
|
RUN addgroup --system app && adduser --system --ingroup app app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY --from=deps /app/apps/planner/node_modules ./apps/planner/node_modules
|
|
COPY --from=build /app/apps/planner/build ./apps/planner/build
|
|
COPY --from=build /app/apps/planner/server.ts ./apps/planner/server.ts
|
|
COPY --from=build /app/apps/planner/app/lib ./apps/planner/app/lib
|
|
COPY --from=build /app/apps/planner/package.json ./apps/planner/package.json
|
|
COPY --from=build /app/packages ./packages
|
|
|
|
WORKDIR /app/apps/planner
|
|
USER app
|
|
EXPOSE 3001
|
|
ENV PORT=3001
|
|
CMD ["node", "--experimental-strip-types", "server.ts"]
|