davidherran
a199891a3c
Deploy to VPS / deploy (push) Has been cancelled
Two production-grade hardening additions and one cost optimisation. FLUXAI AUTONOMY RESTORED (api/chat) - Brings back the multi-step agentic flow that the system prompt was always designed for. The "temporarily removed maxSteps" comment is gone — replaced with the AI SDK 6 equivalent stopWhen: stepCountIs(5). - Cap at 5 chained tool calls per turn bounds latency + LLM cost. - maxDuration raised 30s → 60s to absorb tool-chain runs. - Result: one user prompt now triggers, e.g. search_installations → energy_savings_calculator → show_case_study → schedule_consultation in a single turn — exactly the SPIN methodology in the prompt. RATE LIMITING (src/lib/rateLimit.ts + api/chat) - Token-bucket per IP: 30 messages burst, sustained 30/minute. Trips to 429 with Retry-After + X-RateLimit-Remaining headers when abused. - IP extracted from x-forwarded-for (Nginx already passes this). - In-memory Map with 10-min GC of stale buckets — no Redis dep. If we scale to multiple replicas later, swap the Map for Upstash. - Protects the OpenAI quota from someone hammering the chat endpoint. IMAGE PIPELINE (src/lib/imageOptimizer.ts) - sharp-based optimizer: auto-orient (EXIF), cap at 2560px long side, re-encode WebP@85, content-hash filename. Re-uploads with same content reuse the same hash; new content gets a new URL — perfect cache invalidation without header tricks. - Opt-in via optimize=1 form/query param on /api/assets POST. - Hero CMS and Site Settings uploads turn it on automatically (those are user-facing brand assets where compression matters most). - App/news/parts uploads remain untouched (editors may be uploading CAD drawings, datasheets, etc. that shouldn't be transcoded). - Falls back gracefully to a no-op for unsupported formats (SVG, GIF, videos, anything sharp can't decode) so it never breaks an upload. DOCKERFILE - Adds vips/vips-dev for sharp on Alpine + --include=optional so the @img/sharp-linuxmusl-x64 prebuilt is downloaded - Explicitly copies node_modules/sharp + node_modules/@img to the runner stage (Next.js trace can miss conditional deps). NO DB SCHEMA CHANGES.
79 lines
2.9 KiB
Docker
79 lines
2.9 KiB
Docker
# ═══════════════════════════════════════════════════════════════
|
|
# FLUX SRL — Production Dockerfile (Multi-Stage)
|
|
# Next.js 16 + Prisma + next-intl + AI SDK
|
|
# ═══════════════════════════════════════════════════════════════
|
|
|
|
# ── Stage 1: Install dependencies ──
|
|
FROM node:22-alpine AS deps
|
|
# libc6-compat: glibc shim for prebuilt native binaries (Prisma engines)
|
|
# vips-dev: required for sharp on Alpine — image processing native lib
|
|
RUN apk add --no-cache libc6-compat vips-dev
|
|
WORKDIR /app
|
|
|
|
COPY package.json package-lock.json ./
|
|
# --include=optional ensures @img/sharp-linuxmusl-x64 (the Alpine sharp
|
|
# prebuilt binary) is downloaded; otherwise sharp errors at runtime.
|
|
RUN npm ci --include=optional
|
|
|
|
# ── Stage 2: Build the application ──
|
|
FROM node:22-alpine AS builder
|
|
WORKDIR /app
|
|
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
|
|
# Prisma: generate client for linux-musl (Alpine)
|
|
# NOTE: dummy URL required because prisma.config.ts calls env("DATABASE_URL")
|
|
# during generate. The real URL is injected at runtime via docker-compose.
|
|
RUN DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy" npx prisma generate
|
|
|
|
# Disable telemetry during build
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
ENV DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy"
|
|
|
|
RUN npm run build
|
|
|
|
# ── Stage 3: Production runner ──
|
|
FROM node:22-alpine AS runner
|
|
WORKDIR /app
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
|
|
# vips runtime — required for sharp at runtime, not just build
|
|
RUN apk add --no-cache vips
|
|
|
|
# Security: run as non-root user
|
|
RUN addgroup --system --gid 1001 nodejs
|
|
RUN adduser --system --uid 1001 nextjs
|
|
|
|
# Copy public assets (footage, images, GLB models)
|
|
COPY --from=builder /app/public ./public
|
|
|
|
# Copy standalone build
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
|
|
# Copy Prisma schema + generated client (needed for migrations at runtime)
|
|
COPY --from=builder /app/prisma ./prisma
|
|
COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
|
|
COPY --from=builder /app/node_modules/@prisma ./node_modules/@prisma
|
|
|
|
# Copy sharp binary explicitly — Next.js standalone trace usually picks it
|
|
# up, but the @img/sharp-linuxmusl-x64 prebuilt is platform-conditional and
|
|
# can be missed. Copying both directories guarantees runtime availability.
|
|
COPY --from=builder /app/node_modules/sharp ./node_modules/sharp
|
|
COPY --from=builder /app/node_modules/@img ./node_modules/@img
|
|
|
|
# Copy i18n message files (required by next-intl at runtime)
|
|
COPY --from=builder /app/messages ./messages
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
ENV PORT=3000
|
|
ENV HOSTNAME="0.0.0.0"
|
|
|
|
CMD ["node", "server.js"]
|