Ильяс Султанов
a54ec775dd
Шаг 0.11 плана production-готовности: - триграммные GIN на tasks.title/description (ilike '%…%' без смены семантики) - tasks(organization_id, updated_at DESC), tasks(form_id, updated_at) - field_history(task_id), users(email) Проверено на 100k задач: Seq Scan 77.5ms → Bitmap Index Scan 4.8ms (~16x)
62 lines
2.2 KiB
Docker
62 lines
2.2 KiB
Docker
FROM node:20-alpine AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package*.json ./
|
|
RUN --mount=type=cache,target=/root/.npm npm ci
|
|
|
|
COPY . .
|
|
ARG BUILD_SHA=unknown
|
|
ENV BUILD_SHA=$BUILD_SHA
|
|
RUN npm run build
|
|
|
|
FROM node:20-alpine AS production
|
|
|
|
# Optional mirror for Alpine packages (helps avoid transient I/O errors on dl-cdn)
|
|
ARG ALPINE_MIRROR=
|
|
RUN if [ -n "$ALPINE_MIRROR" ]; then sed -i "s|dl-cdn.alpinelinux.org|$ALPINE_MIRROR|g" /etc/apk/repositories; fi
|
|
|
|
WORKDIR /app
|
|
|
|
# Только production-зависимости: typescript/vite/vitest в образ не попадают.
|
|
# Сервер запускается из esbuild-бандла (dist/index.js, --packages=external),
|
|
# поэтому все runtime-зависимости должны быть в node_modules.
|
|
COPY --from=builder /app/package*.json ./
|
|
RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev
|
|
|
|
COPY --from=builder /app/dist ./dist
|
|
COPY --from=builder /app/shared ./shared
|
|
COPY --from=builder /app/drizzle.config.ts ./drizzle.config.ts
|
|
COPY --from=builder /app/docker-entrypoint.sh ./docker-entrypoint.sh
|
|
COPY --from=builder /app/scripts ./scripts
|
|
COPY --from=builder /app/server/scripts ./server/scripts
|
|
|
|
RUN chmod +x docker-entrypoint.sh
|
|
RUN mkdir -p /app/data
|
|
|
|
# VPN client apps (olcbox APK/IPA)
|
|
COPY --from=builder /app/apps /app/apps
|
|
|
|
# Python + python-docx для обработки DOCX-шаблонов
|
|
RUN apk add --no-cache python3 py3-pip py3-lxml \
|
|
&& pip3 install --break-system-packages python-docx \
|
|
&& rm -rf /root/.cache/pip
|
|
|
|
# Контейнер не работает от root: отдельный пользователь app.
|
|
# /app/data — загрузки (local-режим) и JSON-данные финансов, должна быть доступна на запись.
|
|
# npm при старте (db:migrate/start) пишет кэш — перенаправляем в /tmp.
|
|
RUN adduser -D app && chown -R app:app /app
|
|
ENV npm_config_cache=/tmp/.npm \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
HOME=/tmp
|
|
USER app
|
|
|
|
EXPOSE 5000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
|
|
CMD wget -qO- http://localhost:5000/api/health || exit 1
|
|
|
|
COPY --from=builder /app/migrations ./migrations
|
|
ENTRYPOINT ["./docker-entrypoint.sh"]
|
|
|