edb618fe40
Self-hosted instances no longer inherit the trails.cool flagship Sentry DSNs. Code paths now read DSN strictly from env — unset = no Sentry init, no events sent. Flagship continues to report unchanged: cd-apps.yml and cd-staging.yml inject the public DSNs as workflow env vars, which feed into: - runtime via \`infrastructure/app.env\` / \`staging.env\` (\`SENTRY_DSN_JOURNAL\` / \`SENTRY_DSN_PLANNER\` → compose env per service) - build time via docker build-arg \`VITE_SENTRY_DSN\` (journal only; planner has no client Sentry init). Sentry DSNs are public-by-design (transmitted unencrypted from the client JS bundle), so embedding them as plaintext workflow env vars is no worse than the runtime exposure. Forks should replace these with their own DSNs or remove the workflow env lines to ship Sentry-free. Files changed: - apps/journal/server.ts: \`process.env.SENTRY_DSN\` only, no fallback - apps/planner/server.ts: same - apps/journal/app/lib/sentry.client.ts: \`import.meta.env.VITE_SENTRY_DSN\` only; falsy = skip init - apps/journal/Dockerfile: new \`ARG VITE_SENTRY_DSN\` baked into build - infrastructure/docker-compose.yml: pass \`SENTRY_DSN\` per service - infrastructure/docker-compose.staging.yml: same - .github/workflows/cd-apps.yml: workflow env + build-arg + app.env echo - .github/workflows/cd-staging.yml: same Full repo: pnpm typecheck, pnpm lint, pnpm test, journal build all green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
53 lines
2.2 KiB
Docker
53 lines
2.2 KiB
Docker
FROM node:25-slim AS base
|
|
# curl is used by the docker-compose healthcheck (node:25-slim is Debian
|
|
# trixie-slim and ships neither curl nor wget by default).
|
|
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
|
|
RUN npm install -g pnpm@10.6.5
|
|
WORKDIR /app
|
|
|
|
FROM base AS deps
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY apps/journal/package.json apps/journal/
|
|
COPY packages/types/package.json packages/types/
|
|
COPY packages/ui/package.json packages/ui/
|
|
COPY packages/map/package.json packages/map/
|
|
COPY packages/gpx/package.json packages/gpx/
|
|
COPY packages/i18n/package.json packages/i18n/
|
|
COPY packages/sentry-config/package.json packages/sentry-config/
|
|
COPY packages/api/package.json packages/api/
|
|
COPY packages/map-core/package.json packages/map-core/
|
|
COPY packages/db/package.json packages/db/
|
|
COPY packages/jobs/package.json packages/jobs/
|
|
COPY packages/fit/package.json packages/fit/
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
FROM base AS build
|
|
ARG SENTRY_RELEASE
|
|
# Client-side Sentry DSN baked into the bundle at build time. Empty (or
|
|
# unset) produces a Sentry-free client. Public-by-design: the DSN
|
|
# appears in the shipped client JS regardless.
|
|
ARG VITE_SENTRY_DSN=""
|
|
COPY --from=deps /app/ ./
|
|
COPY . .
|
|
RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
|
|
SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null | tr -d '\n\r')" \
|
|
SENTRY_RELEASE="$SENTRY_RELEASE" \
|
|
VITE_SENTRY_DSN="$VITE_SENTRY_DSN" \
|
|
pnpm --filter @trails-cool/journal build
|
|
|
|
FROM base AS runtime
|
|
RUN addgroup --system app && adduser --system --ingroup app app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY --from=deps /app/apps/journal/node_modules ./apps/journal/node_modules
|
|
COPY --from=build /app/apps/journal/build ./apps/journal/build
|
|
COPY --from=build /app/apps/journal/server.ts ./apps/journal/server.ts
|
|
COPY --from=build /app/apps/journal/app/lib ./apps/journal/app/lib
|
|
COPY --from=build /app/apps/journal/app/jobs ./apps/journal/app/jobs
|
|
COPY --from=build /app/apps/journal/package.json ./apps/journal/package.json
|
|
COPY --from=build /app/packages ./packages
|
|
|
|
WORKDIR /app/apps/journal
|
|
USER app
|
|
EXPOSE 3000
|
|
ENV PORT=3000
|
|
CMD ["node", "--experimental-strip-types", "server.ts"]
|