feat(docker): add Dockerfiles and update next.config.js for admin and storefront applications

- Introduced Dockerfiles for both admin and storefront applications to streamline the build and deployment process using multi-stage builds.
- Configured the Dockerfiles to install dependencies, build the applications, and set up a minimal runtime environment.
- Updated next.config.js for both applications to enable standalone output and set the outputFileTracingRoot for proper file tracing in a monorepo setup.

This commit enhances the containerization of the applications, improving deployment efficiency and reducing image sizes.

.gitea/workflows/deploy-staging.yml

@@ -0,0 +1,160 @@
+name: Deploy — Staging
+
+on:
+  push:
+    branches:
+      - staging
+
+# STAGING_REGISTRY must include the owner segment, e.g. git.yourdomain.com:3000/myorg
+# so images are correctly tagged as git.yourdomain.com:3000/myorg/storefront:staging
+# (see: troubleshooting #8 — missing /owner causes a 500 from Gitea registry)
+#
+# Required secrets:
+#   STAGING_REGISTRY          — host:port/owner  (e.g. git.yourdomain.com:3000/myorg)
+#   STAGING_REGISTRY_USER     — Gitea username
+#   STAGING_REGISTRY_TOKEN    — Gitea personal access token (package:write scope)
+#   STAGING_SSH_HOST          — use host.containers.internal, not the external IP
+#                               (see: troubleshooting #13 — VPS firewall blocks ext IP)
+#   STAGING_SSH_USER          — SSH user on the VPS
+#   STAGING_SSH_KEY           — SSH private key (full PEM)
+#   STAGING_SSH_PORT          — (optional) defaults to 22
+#
+# The Dockerfiles are expected at:
+#   apps/storefront/Dockerfile
+#   apps/admin/Dockerfile
+# Both receive ./out as build context (turbo prune output).
+
+env:
+  REGISTRY: ${{ secrets.STAGING_REGISTRY }}
+
+jobs:
+  # ── 1. CI ───────────────────────────────────────────────────────────────────
+
+  ci:
+    name: Lint, Typecheck & Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npm run type-check
+
+      - name: Test
+        run: npm run test:once
+
+  # ── 2. Build & push ─────────────────────────────────────────────────────────
+  # Runs storefront and admin in parallel via matrix.
+  # Each job prunes its own workspace so there is no out/ directory collision.
+
+  build:
+    name: Build & push — ${{ matrix.app }}
+    needs: ci
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        app: [storefront, admin]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Prune workspace for ${{ matrix.app }}
+        run: npx turbo prune ${{ matrix.app }} --docker
+
+      - name: Authenticate with registry
+        # docker login sends HTTPS even for HTTP-only (insecure) registries, so it
+        # fails before the daemon can handle it. Pre-populating config.json bypasses
+        # login entirely — docker push goes through the Podman daemon which correctly
+        # uses HTTP. (see: troubleshooting #7)
+        run: |
+          mkdir -p ~/.docker
+          AUTH=$(echo -n "${{ secrets.STAGING_REGISTRY_USER }}:${{ secrets.STAGING_REGISTRY_TOKEN }}" | base64 -w 0)
+          REGISTRY_HOST=$(echo "${{ env.REGISTRY }}" | cut -d'/' -f1)
+          echo "{\"auths\":{\"${REGISTRY_HOST}\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+
+      - name: Build & push ${{ matrix.app }}
+        # Plain docker build — no docker/setup-buildx-action needed.
+        # The docker-container buildx driver spawns a privileged builder container
+        # which fails on rootless Podman without --privileged. (see: troubleshooting #5)
+        run: |
+          SHORT_SHA="${GITHUB_SHA::7}"
+          IMAGE="${{ env.REGISTRY }}/${{ matrix.app }}"
+
+          docker build \
+            -f apps/${{ matrix.app }}/Dockerfile \
+            -t "${IMAGE}:staging" \
+            -t "${IMAGE}:sha-${SHORT_SHA}" \
+            ./out
+
+          docker push "${IMAGE}:staging"
+          docker push "${IMAGE}:sha-${SHORT_SHA}"
+
+  # ── 3. Deploy ───────────────────────────────────────────────────────────────
+
+  deploy:
+    name: Deploy to staging VPS
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Write SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.STAGING_SSH_KEY }}" > ~/.ssh/staging
+          chmod 600 ~/.ssh/staging
+
+      - name: Pull & restart containers on VPS
+        env:
+          REGISTRY: ${{ secrets.STAGING_REGISTRY }}
+          REGISTRY_USER: ${{ secrets.STAGING_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.STAGING_REGISTRY_TOKEN }}
+          SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+          SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+          SSH_PORT: ${{ secrets.STAGING_SSH_PORT }}
+        run: |
+          # Auth key is the hostname only — strip the /owner path
+          REGISTRY_HOST=$(echo "$REGISTRY" | cut -d'/' -f1)
+
+          # StrictHostKeyChecking=accept-new trusts on first connect but rejects
+          # changed keys on subsequent runs — safer than no-verify
+          ssh -i ~/.ssh/staging \
+              -p "${SSH_PORT:-22}" \
+              -o StrictHostKeyChecking=accept-new \
+              "${SSH_USER}@${SSH_HOST}" bash -s << EOF
+          set -euo pipefail
+
+          # Registry uses HTTP — --tls-verify=false required for podman login & pull
+          # (see: troubleshooting #12)
+          echo "${REGISTRY_TOKEN}" \
+            | podman login "${REGISTRY_HOST}" \
+                -u "${REGISTRY_USER}" --password-stdin --tls-verify=false
+
+          podman pull --tls-verify=false "${REGISTRY}/storefront:staging"
+          podman pull --tls-verify=false "${REGISTRY}/admin:staging"
+
+          cd /opt/staging
+          podman compose up -d --remove-orphans
+
+          # Remove dangling images from previous deploys
+          podman image prune -f
+          EOF

apps/admin/Dockerfile

@@ -0,0 +1,48 @@
+# Build context: ./out  (turbo prune admin --docker)
+# out/json/  — package.json files only   → used by deps stage for layer caching
+# out/full/  — full pruned monorepo       → used by builder stage for source
+# out/package-lock.json
+
+# ── Stage 1: deps ────────────────────────────────────────────────────────────
+FROM node:20-alpine AS deps
+
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+
+COPY json/ .
+COPY package-lock.json .
+RUN npm ci
+
+# ── Stage 2: builder ─────────────────────────────────────────────────────────
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY full/ .
+
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN npx turbo build --filter=admin
+
+# ── Stage 3: runner ──────────────────────────────────────────────────────────
+FROM node:20-alpine AS runner
+
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    HOSTNAME=0.0.0.0 \
+    PORT=3001
+
+RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
+
+COPY --from=builder --chown=nextjs:nodejs /app/apps/admin/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/apps/admin/.next/static ./apps/admin/.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/apps/admin/public ./apps/admin/public
+
+USER nextjs
+
+EXPOSE 3001
+
+CMD ["node", "server.js"]

apps/admin/next.config.js

@@ -3,6 +3,8 @@ const path = require("path");
 
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  output: "standalone",
+  outputFileTracingRoot: path.join(__dirname, "../.."),
   transpilePackages: ["@repo/convex", "@repo/types", "@repo/utils"],
   turbopack: {
     root: path.join(__dirname, "..", ".."),

apps/storefront/Dockerfile

@@ -0,0 +1,59 @@
+# Build context: ./out  (turbo prune storefront --docker)
+# out/json/  — package.json files only   → used by deps stage for layer caching
+# out/full/  — full pruned monorepo       → used by builder stage for source
+# out/package-lock.json
+
+# ── Stage 1: deps ────────────────────────────────────────────────────────────
+# Install ALL dependencies (dev + prod) using only the package.json tree.
+# This layer is shared with the builder stage and only rebuilds when
+# a package.json or the lock file changes — not when source code changes.
+FROM node:20-alpine AS deps
+
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+
+COPY json/ .
+COPY package-lock.json .
+RUN npm ci
+
+# ── Stage 2: builder ─────────────────────────────────────────────────────────
+# Full monorepo source + build artifact.
+# next build produces .next/standalone/ because output: "standalone" is set
+# in next.config.js — that's what makes the runner stage small.
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY full/ .
+
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN npx turbo build --filter=storefront
+
+# ── Stage 3: runner ──────────────────────────────────────────────────────────
+# Minimal runtime image — only the standalone bundle, static assets, and public dir.
+# No source code, no dev dependencies, no build tools.
+FROM node:20-alpine AS runner
+
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    HOSTNAME=0.0.0.0 \
+    PORT=3000
+
+# Non-root user for security
+RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
+
+# standalone output mirrors the monorepo tree, so server.js lands at /app/server.js
+# Static files and public/ must be copied separately — they are not in standalone/
+COPY --from=builder --chown=nextjs:nodejs /app/apps/storefront/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/apps/storefront/.next/static ./apps/storefront/.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/apps/storefront/public ./apps/storefront/public
+
+USER nextjs
+
+EXPOSE 3000
+
+CMD ["node", "server.js"]

apps/storefront/next.config.js

@@ -3,6 +3,10 @@ const path = require("path");
 
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  output: "standalone",
+  // Required in a monorepo: tells Next.js to trace files from the repo root
+  // so the standalone bundle includes files from packages/
+  outputFileTracingRoot: path.join(__dirname, "../.."),
   transpilePackages: ["@repo/convex", "@repo/types", "@repo/utils"],
   turbopack: {
     root: path.join(__dirname, "..", ".."),