schalli
ae8fecb538
Die duenne Strecke Skript -> Abbild -> API beweisen (D-08, D-10): - desktop-collect.sh sammelt AppImage/exe ein, schreibt manifest.json (Version, Kanal, Commit, Groesse, SHA-256) ohne Secrets - apps/api/src/desktop/: neues Modul mit GET /desktop/latest und GET /desktop/download/:platform, beide @Public(); Plattform-Whitelist vor jedem Dateisystemzugriff, Dateiname ausschliesslich aus dem Manifest (T-18-01, T-18-02) - packages/shared: DesktopPlatform/-Manifest(File)/-Latest(Response) Typen - Dockerfile kopiert desktop-dist/ in die runner-Stufe; desktop-dist/ per .gitkeep + .gitignore versioniert (leeres Verzeichnis, Pakete bleiben ungetrackt) - HTTP-Durchstich-Spec (8 Tests) via NestFactory, kein fs-Mock; echtes Temp-Verzeichnis + unabhaengig berechneter SHA-256 Abweichung: DesktopController braucht @Inject(DesktopService) explizit — Vitest transpiliert ueber esbuild, das emitDecoratorMetadata nicht abbildet, sonst bleibt desktopService bei einem echten NestFactory-Bau undefined (Rule 3, Blocker). Lokal bewiesen: neu gebautes API-Abbild liefert /desktop/latest (200) und /desktop/download/linux (200, attachment) aus, auch ueber /api-proxy/ des Web-Containers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
57 lines
2.3 KiB
Docker
57 lines
2.3 KiB
Docker
# Versionsstempel (quick-260914-ku1): die Werte setzt .gitea/scripts/publish-images.sh
|
|
# per --build-arg; lokal greifen die Vorgaben (dev). Ein globales ARG liefert nur die
|
|
# Vorgabe -- jede nutzende Stufe wiederholt deshalb `ARG NAME` ohne Wert.
|
|
ARG APP_VERSION=dev
|
|
ARG APP_CHANNEL=dev
|
|
ARG APP_COMMIT=
|
|
ARG APP_BUILD_TIME=
|
|
|
|
FROM node:24-alpine AS base
|
|
RUN corepack enable && corepack prepare pnpm@9 --activate
|
|
|
|
FROM base AS deps
|
|
WORKDIR /app
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY apps/api/package.json ./apps/api/
|
|
COPY packages/shared/package.json ./packages/shared/
|
|
RUN pnpm install --frozen-lockfile --filter=@tessera/api...
|
|
|
|
FROM base AS builder
|
|
WORKDIR /app
|
|
COPY --from=deps /app/ ./
|
|
COPY apps/api/ ./apps/api/
|
|
COPY packages/shared/ ./packages/shared/
|
|
COPY tsconfig.base.json ./
|
|
RUN pnpm --filter=@tessera/api exec prisma generate
|
|
RUN pnpm --filter=@tessera/api build
|
|
|
|
FROM base AS runner
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
ARG APP_VERSION
|
|
ARG APP_CHANNEL
|
|
ARG APP_COMMIT
|
|
ARG APP_BUILD_TIME
|
|
ENV APP_VERSION=$APP_VERSION APP_CHANNEL=$APP_CHANNEL APP_COMMIT=$APP_COMMIT APP_BUILD_TIME=$APP_BUILD_TIME
|
|
RUN addgroup --system --gid 1001 nestjs && \
|
|
adduser --system --uid 1001 nestjs && \
|
|
mkdir -p /app/user-files && \
|
|
chown nestjs:nestjs /app/user-files
|
|
COPY --from=deps /app/package.json /app/pnpm-workspace.yaml /app/pnpm-lock.yaml ./
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY --from=deps /app/apps/api/node_modules ./apps/api/node_modules
|
|
COPY --from=deps /app/apps/api/package.json ./apps/api/
|
|
COPY --from=deps /app/packages/shared/package.json ./packages/shared/
|
|
COPY --from=builder /app/apps/api/dist ./apps/api/dist
|
|
COPY --from=builder /app/node_modules/.pnpm/@prisma+client@6.19.3_prisma@6.19.3_typescript@5.9.3__typescript@5.9.3/node_modules/.prisma ./node_modules/.pnpm/@prisma+client@6.19.3_prisma@6.19.3_typescript@5.9.3__typescript@5.9.3/node_modules/.prisma
|
|
COPY --from=builder /app/apps/api/prisma ./apps/api/prisma
|
|
COPY --from=builder /app/packages/shared/src ./packages/shared/src
|
|
COPY apps/api/scripts ./apps/api/scripts
|
|
# Desktop-Pakete (Phase 18, D-08): im CI legt desktop-collect.sh Pakete +
|
|
# manifest.json in diesen Ordner, lokal liegt nur der Platzhalter. Nur
|
|
# lesend zur Laufzeit -- kein chown noetig.
|
|
COPY desktop-dist ./desktop-dist
|
|
USER nestjs
|
|
EXPOSE 3001
|
|
CMD ["sh", "apps/api/scripts/migrate-and-start.sh"]
|