mirror of
https://github.com/makeplane/plane.git
synced 2026-09-01 19:48:42 +02:00
effd0c5719
* refactor: migrate from nginx to Caddy for admin and web services
- Updated Dockerfiles to use Caddy as the web server instead of nginx.
- Added Caddyfile configurations for both admin and web services.
- Implemented rate limiting in Caddy using xcaddy.
- Adjusted healthcheck endpoint to reflect new routing in Caddy.
* refactor: remove nginx configuration files for admin and web services
- Deleted nginx.conf files as part of the migration to Caddy.
- Updated Dockerfile to reflect changes in the Caddy build process.
* fix: address review feedback on Caddy configuration
- admin: fix SPA fallback to /god-mode/index.html so deep links resolve
- restrict trusted_proxies to private_ranges instead of 0.0.0.0
- wire rate_limit zone so the compiled caddy-ratelimit module is used
* fix: use client_ip for rate limiting and restore security headers
- rate_limit key {remote_host} -> {client_ip} so per-client buckets are
keyed on the real client IP forwarded by the proxy, not the proxy
connection source
- restore security headers previously emitted by nginx
(X-Frame-Options, X-Content-Type-Options, X-XSS-Protection);
HSTS remains at the TLS terminator
---------
Co-authored-by: Pratapa Lakshmi <gouthampratapa8@gmail.com>
99 lines
3.2 KiB
Docker
99 lines
3.2 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
FROM node:22-alpine AS base
|
|
|
|
# Setup pnpm package manager with corepack and configure global bin directory for caching
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
|
|
RUN corepack enable
|
|
|
|
# *****************************************************************************
|
|
# STAGE 1: Build the project
|
|
# *****************************************************************************
|
|
FROM base AS builder
|
|
RUN apk add --no-cache libc6-compat
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
ARG TURBO_VERSION=2.9.18
|
|
RUN corepack enable pnpm && pnpm add -g turbo@${TURBO_VERSION}
|
|
COPY . .
|
|
|
|
RUN turbo prune --scope=web --docker
|
|
|
|
# *****************************************************************************
|
|
# STAGE 2: Install dependencies & build the project
|
|
# *****************************************************************************
|
|
# Add lockfile and package.json's of isolated subworkspace
|
|
FROM base AS installer
|
|
|
|
RUN apk add --no-cache libc6-compat
|
|
WORKDIR /app
|
|
|
|
# First install the dependencies (as they change less often)
|
|
COPY .gitignore .gitignore
|
|
COPY --from=builder /app/out/json/ .
|
|
COPY --from=builder /app/out/pnpm-lock.yaml ./pnpm-lock.yaml
|
|
RUN corepack enable pnpm
|
|
|
|
# Copy full directory structure before fetch to ensure all package.json files are available
|
|
COPY --from=builder /app/out/full/ .
|
|
COPY turbo.json turbo.json
|
|
|
|
# Fetch dependencies to cache store, then install offline with dev deps
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm fetch --store-dir=/pnpm/store
|
|
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store CI=true pnpm install --offline --frozen-lockfile --store-dir=/pnpm/store
|
|
|
|
ARG VITE_API_BASE_URL=""
|
|
ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
|
|
|
|
ARG VITE_ADMIN_BASE_URL=""
|
|
ENV VITE_ADMIN_BASE_URL=$VITE_ADMIN_BASE_URL
|
|
|
|
ARG VITE_ADMIN_BASE_PATH="/god-mode"
|
|
ENV VITE_ADMIN_BASE_PATH=$VITE_ADMIN_BASE_PATH
|
|
|
|
ARG VITE_LIVE_BASE_URL=""
|
|
ENV VITE_LIVE_BASE_URL=$VITE_LIVE_BASE_URL
|
|
|
|
ARG VITE_LIVE_BASE_PATH="/live"
|
|
ENV VITE_LIVE_BASE_PATH=$VITE_LIVE_BASE_PATH
|
|
|
|
ARG VITE_SPACE_BASE_URL=""
|
|
ENV VITE_SPACE_BASE_URL=$VITE_SPACE_BASE_URL
|
|
|
|
ARG VITE_SPACE_BASE_PATH="/spaces"
|
|
ENV VITE_SPACE_BASE_PATH=$VITE_SPACE_BASE_PATH
|
|
|
|
ARG VITE_WEB_BASE_URL=""
|
|
ENV VITE_WEB_BASE_URL=$VITE_WEB_BASE_URL
|
|
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV TURBO_TELEMETRY_DISABLED=1
|
|
|
|
RUN pnpm turbo run build --filter=web
|
|
|
|
# *****************************************************************************
|
|
# STAGE 3: Serve with Caddy
|
|
# *****************************************************************************
|
|
FROM caddy:2.11-builder-alpine AS caddy-builder
|
|
|
|
RUN xcaddy build \
|
|
--with github.com/mholt/caddy-ratelimit
|
|
|
|
FROM caddy:2.11-alpine AS production
|
|
|
|
# curl is required by the HEALTHCHECK below and is not present in the base image
|
|
RUN apk update && apk upgrade --no-cache && apk add --no-cache curl && rm -rf /var/cache/apk/*
|
|
|
|
COPY --from=caddy-builder /usr/bin/caddy /usr/bin/caddy
|
|
|
|
COPY apps/web/caddy/Caddyfile /etc/caddy/Caddyfile
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -fsS http://127.0.0.1:3000/ >/dev/null || exit 1
|
|
|
|
COPY --from=installer /app/apps/web/build/client /usr/share/caddy/html
|
|
|
|
EXPOSE 3000
|
|
|
|
CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile"] |