Container images and Woodpecker CI pipeline

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker/compose.example.yml

@@ -0,0 +1,31 @@
+# Example deployment. Put the reverse proxy (Authelia on /api/admin) in front, as described in README.
+services:
+  server-be:
+    image: git.aggtaa.com/anton/cardy-server-be:main
+    restart: unless-stopped
+    environment:
+      KEY_ENCRYPTION_SECRET: ${KEY_ENCRYPTION_SECRET}
+      SUPERADMIN_EMAIL: ${SUPERADMIN_EMAIL}
+      ADMIN_PROXY_SECRET: ${ADMIN_PROXY_SECRET}   # the container listens on 0.0.0.0, so set it
+      PUBLIC_API_URL: https://dev.aggtaa.com/api
+    volumes:
+      - cardy-data:/data
+    ports:
+      - "127.0.0.1:10002:10002"
+
+  server-fe:
+    image: git.aggtaa.com/anton/cardy-server-fe:main
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:10001:10001"
+
+  mobile-client:
+    image: git.aggtaa.com/anton/cardy-mobile-client:main
+    restart: unless-stopped
+    volumes:
+      - ./updates/android:/updates:ro   # output of `publish:android` / `publish:android-apk`
+    ports:
+      - "127.0.0.1:10003:10003"
+
+volumes:
+  cardy-data:

docker/mobile-client.Dockerfile

@@ -0,0 +1,19 @@
+# Build context: repository root.
+FROM node:22-alpine AS build
+RUN corepack enable
+WORKDIR /repo
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json tsconfig.base.json ./
+COPY shared ./shared
+COPY mobile-client ./mobile-client
+RUN pnpm install --frozen-lockfile --filter @cardy/mobile-client...
+# CARDY_UPDATE_URL is baked into the web build (where the Android app looks for live updates).
+ARG CARDY_UPDATE_URL=https://dev.aggtaa.com/m/android
+ENV CARDY_UPDATE_URL=$CARDY_UPDATE_URL
+RUN pnpm --filter @cardy/mobile-client exec vite build
+
+FROM nginxinc/nginx-unprivileged:alpine
+COPY docker/nginx-mobile.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /repo/mobile-client/dist /usr/share/nginx/html
+# Android updates (version.json, bundles, APK) published with `publish:android*` are mounted here.
+VOLUME /updates
+EXPOSE 10003

docker/nginx-mobile.conf

@@ -0,0 +1,31 @@
+# The reverse proxy strips /m before forwarding, so files are looked up at the root.
+# The "/m/" form is also accepted for direct access.
+server {
+    listen 10003;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    rewrite ^/m/(.*)$ /$1 last;
+
+    # Published Android updates; open CORS because the app runs on https://localhost.
+    location /android/ {
+        alias /updates/;
+        add_header Access-Control-Allow-Origin "*";
+        add_header Cache-Control "no-cache";
+        try_files $uri =404;
+    }
+
+    location /assets/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    # Service worker and manifest must always be revalidated.
+    location ~ ^/(sw\.js|workbox-.*\.js|registerSW\.js|manifest\.webmanifest|index\.html)$ {
+        add_header Cache-Control "no-cache";
+    }
+
+    location / {
+        add_header Cache-Control "no-cache";
+        try_files $uri /index.html;
+    }
+}

docker/nginx-spa.conf

@@ -0,0 +1,14 @@
+server {
+    listen 10001;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location /assets/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    location / {
+        add_header Cache-Control "no-cache";
+        try_files $uri /index.html;
+    }
+}

docker/server-be.Dockerfile

@@ -0,0 +1,26 @@
+# Build context: repository root.
+FROM node:22-alpine AS build
+RUN corepack enable
+WORKDIR /repo
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json tsconfig.base.json ./
+COPY shared ./shared
+COPY server-be ./server-be
+# Only the workspace packages needed by server-be (the other ones are not copied).
+RUN pnpm install --frozen-lockfile --filter @cardy/server-be...
+RUN pnpm --filter @cardy/server-be build \
+ && pnpm --filter @cardy/server-be --prod deploy --legacy /out
+
+FROM node:22-alpine
+ENV NODE_ENV=production \
+    DATA_DIR=/data \
+    HOST=0.0.0.0 \
+    PORT=10002
+WORKDIR /app
+COPY --from=build /out/package.json ./package.json
+COPY --from=build /out/node_modules ./node_modules
+COPY --from=build /out/dist ./dist
+RUN mkdir -p /data && chown node:node /data
+USER node
+VOLUME /data
+EXPOSE 10002
+CMD ["node", "dist/index.js"]

docker/server-fe.Dockerfile

@@ -0,0 +1,14 @@
+# Build context: repository root.
+FROM node:22-alpine AS build
+RUN corepack enable
+WORKDIR /repo
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json tsconfig.base.json ./
+COPY shared ./shared
+COPY server-fe ./server-fe
+RUN pnpm install --frozen-lockfile --filter @cardy/server-fe...
+RUN pnpm --filter @cardy/server-fe build
+
+FROM nginxinc/nginx-unprivileged:alpine
+COPY docker/nginx-spa.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /repo/server-fe/dist /usr/share/nginx/html
+EXPOSE 10001