tillandClaude Opus 5
4ff9f8b7a0
- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the workflow could never have gone green. CI and `engines` now say 22.6. - `docker compose up -d` failed on the documented path: the compose files require DB_PASSWORD and .env.example never mentioned it. Documented, and the README no longer claims "three secrets". - The secret scanner treated any comment line as safe, so a pasted `.env` fragment — the usual way a key gets committed — slipped through. Verified against planted keys before and after. - Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user could still open /shares, /library and /queue and read about features the instance does not have. They now redirect, matching the API's 404 behaviour. - German left in the English build: `bild.<ext>` as a download fallback, and 31 t() keys with no German at all — the whole main navigation among them, so a German instance rendered its nav in English. Dictionary now covers every key in the source (1,067 entries). - Third-party names removed from the data as well as the labels: the `theframe` format id is now `tv169`, and the dead Cricut admin field is gone. - Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`. - Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts explains why presigned URLs are not needed), a dead `/g/` entry in the unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing read. Documented TRUSTED_PROXIES, which the rate limiter does read. - Migration 004 still had "nas" in its filename; README said A6–A2 where the list runs A6–A1; two committed screenshots were referenced nowhere. 124 tests green, type check clean, build clean, secret scan clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
25 lines
835 B
Docker
25 lines
835 B
Docker
FROM node:22-bookworm-slim
|
|
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production PORT=4321 HOST=0.0.0.0
|
|
|
|
# Build tools for the native modules (argon2). sharp ships a prebuilt libvips.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
python3 make g++ ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# The lockfile comes first and `npm ci` honours it, so the image is built from
|
|
# the exact versions CI tested — not from whatever `^` resolved to today.
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --no-audit --no-fund
|
|
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
EXPOSE 4321
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||4321)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
|
|
CMD ["node", "./dist/server/entry.mjs"]
|