Dennis
1c545c93b4
Security: - Add CRON_SECRET auth to /api/cron/* endpoints - Add admin role verification to /api/admin/* routes - Add org membership check to /api/billing/usage - Add security headers (HSTS, X-Frame-Options, CSP, etc.) - Add env variable validation at startup - Add rate limiting to backend API (30 req/min per IP) Infrastructure: - Multi-stage Dockerfiles with non-root user + healthchecks - Updated cron workflow to pass CRON_SECRET header - Updated .env.example with all optional vars Smart subpage scanning: - Crawler now computes template_hash (DOM structure without content) - Scanner scans ALL unique-layout pages, not just main page - Pages with same layout (e.g. product pages) scanned only once - Deduplication by template_hash, fallback to content_hash - Main page always scanned with high priority - Re-checks subscription limits before each page scan Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
39 lines
1014 B
Docker
39 lines
1014 B
Docker
# --- Stage 1: Dependencies ---
|
|
FROM node:20-slim AS deps
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
|
|
# --- Stage 2: Build ---
|
|
FROM node:20-slim AS builder
|
|
WORKDIR /app
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV TAILWIND_DISABLE_OXIDE=1
|
|
RUN npm run build
|
|
|
|
# --- Stage 3: Production ---
|
|
FROM node:20-slim AS runtime
|
|
WORKDIR /app
|
|
|
|
RUN groupadd -r app && useradd -r -g app -d /app app
|
|
|
|
COPY --from=builder --chown=app:app /app/.next/standalone ./
|
|
COPY --from=builder --chown=app:app /app/.next/static ./.next/static
|
|
COPY --from=builder --chown=app:app /app/public ./public
|
|
|
|
USER app
|
|
|
|
EXPOSE 3000
|
|
|
|
ENV PORT=3000
|
|
ENV HOSTNAME="0.0.0.0"
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD node -e "const h=require('http');h.get('http://localhost:3000/api/health',(r)=>{process.exit(r.statusCode===200?0:1)}).on('error',()=>process.exit(1))"
|
|
|
|
CMD ["node", "server.js"]
|