makiolaj
8a1eb54a45
Each policy now has exactly one copy: docs/PRIVACY.md in the app's own repository. The pages keep their URLs and chrome and render that file through a content collection, so the published page and the app's own documentation cannot drift. scripts/sync-external.mjs shallow-clones both repos into external/ from prebuild and predev — not from CI: Coolify builds the site from the repo, so a checkout that only ran in a Gitea job would never reach the deploy. It falls back to the raw file if git is unavailable, and takes <APP>_REF or <APP>_LOCAL for work against a branch or an unpushed working copy. A missing, empty or malformed policy fails the build, verified against the real image: the deploy stops rather than publishing an empty privacy page.
31 lines
1.2 KiB
Docker
31 lines
1.2 KiB
Docker
# --- Build stage: produce static dist/ ---
|
|
# Debian (glibc), not alpine: Astro 7's Rust toolchain (rolldown/oxc) resolves
|
|
# cleanly against the linux-x64-gnu lockfile entries.
|
|
FROM node:22-slim AS build
|
|
WORKDIR /app
|
|
|
|
# Use npm install (not npm ci): Astro 7's wasm32 optional deps (@emnapi/*)
|
|
# make npm ci's strict lock-sync check fail across npm/node versions. install
|
|
# reconciles the lockfile and builds reliably.
|
|
# git: the build fetches the app repositories whose docs/PRIVACY.md this site
|
|
# renders (scripts/sync-external.mjs, run from `prebuild`). node:slim ships
|
|
# without it; the script would fall back to fetching the raw files over HTTPS,
|
|
# but a shallow clone is the intended path and keeps the failure modes obvious.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY package.json package-lock.json* ./
|
|
RUN npm install --no-audit --no-fund
|
|
|
|
COPY . .
|
|
# PUBLIC_* env vars are inlined at build time. In Coolify, set them as
|
|
# build-time variables so analytics is baked into the static output.
|
|
RUN npm run build
|
|
|
|
# --- Runtime stage: serve dist/ with Caddy ---
|
|
FROM caddy:2-alpine AS runtime
|
|
COPY Caddyfile /etc/caddy/Caddyfile
|
|
COPY --from=build /app/dist /srv
|
|
EXPOSE 80
|