Skip to content

Commit 07d78e7

Browse files
gamerg21gamerg21
authored
Merge pull request #14 from gamerg21/code-formatting-updates
Enhanced Docker Build/Image Update & HTTPS
2 parents 1d4a2b7 + b8132aa commit 07d78e7

File tree

9 files changed

+644
-46
lines changed

9 files changed

+644
-46
lines changed

‎DEPLOYMENT.md‎

Lines changed: 60 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,57 @@ docker-compose -f docker-compose.prod.yml logs -f app
102102

103103
Access the application at `http://localhost:3000` (or your configured port).
104104

105+
## HTTPS Configuration
106+
107+
Safari on iPhones requires HTTPS for barcode scanning. You have two options:
108+
109+
### Option 1: Auto-generated Self-signed Certificates (Quick Setup)
110+
111+
1. **Enable HTTPS in your `.env` file:**
112+
```env
113+
ENABLE_HTTPS=true
114+
NEXTAUTH_URL=https://localhost:3000
115+
```
116+
117+
2. **Restart containers:**
118+
```bash
119+
docker-compose -f docker-compose.prod.yml up -d
120+
```
121+
122+
The app will automatically generate self-signed certificates. Browsers will show a security warning, but Safari barcode scanning will work.
123+
124+
### Option 2: Custom Certificates
125+
126+
1. **Create a `certs` directory and add your certificates:**
127+
```bash
128+
mkdir -p certs
129+
# Copy your cert.pem and key.pem files here
130+
```
131+
132+
2. **Enable HTTPS in `.env`:**
133+
```env
134+
ENABLE_HTTPS=true
135+
SSL_CERT_PATH=/app/certs/cert.pem
136+
SSL_KEY_PATH=/app/certs/key.pem
137+
NEXTAUTH_URL=https://yourdomain.com
138+
```
139+
140+
3. **Certificates are automatically mounted** via the volume in `docker-compose.prod.yml`
141+
142+
### Option 3: nginx Reverse Proxy (Recommended for Production)
143+
144+
For production deployments, use nginx (or Traefik/Caddy) to handle SSL termination:
145+
146+
1. **Keep HTTPS disabled in the app:**
147+
```env
148+
ENABLE_HTTPS=false
149+
NEXTAUTH_URL=https://yourdomain.com
150+
```
151+
152+
2. **Configure nginx with SSL** (see [DOCKER.md](./DOCKER.md) for full example)
153+
154+
This approach allows you to use Let's Encrypt certificates and is the recommended setup for production.
155+
105156
## Updating to Latest Version
106157

107158
To update to the latest version:
@@ -196,12 +247,15 @@ Then update `DATABASE_URL` accordingly and restart.
196247

197248
## Production Deployment Tips
198249

199-
1. **Use a reverse proxy** (nginx, Traefik, Caddy) for HTTPS
200-
2. **Set strong passwords** for database and NextAuth secret
201-
3. **Configure SMTP** for email authentication
202-
4. **Use environment-specific tags** (e.g., `v1.0.0` instead of `latest`)
203-
5. **Set up regular backups** of your database
204-
6. **Monitor logs** for errors and performance issues
250+
1. **Use a reverse proxy** (nginx, Traefik, Caddy) for HTTPS with Let's Encrypt certificates
251+
- Keep `ENABLE_HTTPS=false` in the app and let the proxy handle SSL
252+
2. **For self-hosted instances**, enable `ENABLE_HTTPS=true` for auto-generated self-signed certs
253+
- Safari will show a warning but barcode scanning will work
254+
3. **Set strong passwords** for database and NextAuth secret
255+
4. **Configure SMTP** for email authentication
256+
5. **Use environment-specific tags** (e.g., `v1.0.0` instead of `latest`)
257+
6. **Set up regular backups** of your database
258+
7. **Monitor logs** for errors and performance issues
205259

206260
## Support
207261

‎DOCKER.md‎

Lines changed: 65 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,47 @@ docker-compose ps
8383

8484
The application will be available at `http://localhost:3000` (or your configured port).
8585

86+
### 4.5. Enable HTTPS (Optional)
87+
88+
Safari on iPhones requires HTTPS for barcode scanning. You can enable HTTPS in two ways:
89+
90+
#### Option A: Auto-generated Self-signed Certificates (Easiest)
91+
92+
1. **Set `ENABLE_HTTPS=true` in your `.env` file:**
93+
```env
94+
ENABLE_HTTPS=true
95+
NEXTAUTH_URL=https://localhost:3000
96+
```
97+
98+
2. **Restart containers:**
99+
```bash
100+
docker-compose up -d
101+
```
102+
103+
The app will automatically generate self-signed certificates on first startup. Browsers will show a security warning, but you can proceed and Safari barcode scanning will work.
104+
105+
#### Option B: Custom Certificates
106+
107+
1. **Generate or obtain your SSL certificates** and place them in a `certs` directory:
108+
```bash
109+
mkdir -p certs
110+
# Copy your cert.pem and key.pem files here
111+
# Or use the provided script:
112+
./scripts/generate-self-signed-cert.sh
113+
```
114+
115+
2. **Enable HTTPS in `.env`:**
116+
```env
117+
ENABLE_HTTPS=true
118+
SSL_CERT_PATH=/app/certs/cert.pem
119+
SSL_KEY_PATH=/app/certs/key.pem
120+
NEXTAUTH_URL=https://yourdomain.com
121+
```
122+
123+
3. **The certificates will be automatically mounted** via the volume in `docker-compose.yml`
124+
125+
**Note:** For production with proper SSL certificates, consider using a reverse proxy (nginx, Traefik, Caddy) with `ENABLE_HTTPS=false` and let the proxy handle SSL termination.
126+
86127
### 4. Run Database Migrations
87128

88129
Migrations run automatically on container startup. If you need to run them manually:
@@ -105,14 +146,31 @@ docker-compose exec postgres psql -U postgres -d souschef -c "UPDATE \"User\" SE
105146

106147
### Using a Reverse Proxy
107148

108-
For production, use a reverse proxy (nginx, Traefik, Caddy) in front of the application:
149+
For production, use a reverse proxy (nginx, Traefik, Caddy) in front of the application. This is the recommended approach for production deployments.
150+
151+
**Important:** When using a reverse proxy, keep `ENABLE_HTTPS=false` in your `.env` file and let the proxy handle SSL termination.
109152

110-
#### Example nginx configuration:
153+
#### Example nginx configuration with SSL:
111154

112155
```nginx
113156
server {
114157
listen 80;
115158
server_name souschef.yourdomain.com;
159+
return 301 https://$server_name$request_uri;
160+
}
161+
162+
server {
163+
listen 443 ssl http2;
164+
server_name souschef.yourdomain.com;
165+
166+
# SSL certificates (use Let's Encrypt for production)
167+
ssl_certificate /etc/letsencrypt/live/souschef.yourdomain.com/fullchain.pem;
168+
ssl_certificate_key /etc/letsencrypt/live/souschef.yourdomain.com/privkey.pem;
169+
170+
# SSL configuration
171+
ssl_protocols TLSv1.2 TLSv1.3;
172+
ssl_ciphers HIGH:!aNULL:!MD5;
173+
ssl_prefer_server_ciphers on;
116174
117175
location / {
118176
proxy_pass http://localhost:3000;
@@ -133,6 +191,7 @@ server {
133191
In your `.env` file, set:
134192

135193
```env
194+
ENABLE_HTTPS=false # Let nginx handle SSL
136195
NEXTAUTH_URL=https://souschef.yourdomain.com
137196
```
138197

@@ -346,6 +405,10 @@ sudo chown -R 999:999 ./postgres_data
346405
| `NEXTAUTH_SECRET` | Yes | Secret for NextAuth.js | - |
347406
| `NEXTAUTH_URL` | Yes | Public URL of your application | `http://localhost:3000` |
348407
| `APP_PORT` | No | Application port (host) | `3000` |
408+
| `ENABLE_HTTPS` | No | Enable HTTPS mode (auto-generates self-signed certs if not provided) | `false` |
409+
| `SSL_CERT_PATH` | No | Path to SSL certificate file | `/app/certs/cert.pem` |
410+
| `SSL_KEY_PATH` | No | Path to SSL private key file | `/app/certs/key.pem` |
411+
| `HOSTNAME` | No | Hostname to bind to | `0.0.0.0` |
349412
| `SMTP_HOST` | No | SMTP server hostname | - |
350413
| `SMTP_PORT` | No | SMTP server port | `587` |
351414
| `SMTP_USER` | No | SMTP username | - |

‎Dockerfile‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,20 +47,44 @@ RUN adduser --system --uid 1001 nextjs
4747
# Copy necessary files from standalone build
4848
# Note: standalone build includes the minimal server, but we need to ensure
4949
# Prisma files are available for migrations
50+
# Copy the entire standalone directory to preserve all Next.js internal structure
5051
COPY --from=builder /app/.next/standalone ./
5152
COPY --from=builder /app/.next/static ./.next/static
5253
COPY --from=builder /app/public ./public
5354

55+
# Copy the .next/server directory which contains compiled webpack files
56+
# that Next.js needs even in standalone mode
57+
COPY --from=builder /app/.next/server ./.next/server
58+
59+
# Since we're using a custom server.js, we need all node_modules
60+
# Standalone mode doesn't include everything needed for custom servers
61+
# Copy all node_modules from builder to ensure all dependencies are available
62+
COPY --from=builder /app/node_modules ./node_modules
63+
5464
# Copy Prisma files (needed for migrations and client)
5565
# These are needed even though standalone might include them, to ensure migrations work
5666
COPY --from=builder /app/src/generated ./src/generated
5767
COPY --from=builder /app/prisma ./prisma
5868
COPY --from=builder /app/prisma.config.js ./prisma.config.js
5969
COPY --from=builder /app/package.json ./package.json
6070

71+
# Ensure Next.js module is properly available
72+
# Standalone build should include next, but we ensure it's accessible
73+
# The standalone build's node_modules should already have next, but we verify it's there
74+
75+
# Copy our custom server.js to override the one from standalone build
76+
# This enables our HTTPS/HTTP flexible server functionality
77+
COPY --from=builder /app/server.js ./server.js
78+
6179
# Install Prisma CLI globally for migrations (lightweight)
6280
RUN npm install -g prisma@^7.2.0
6381

82+
# Install OpenSSL for certificate generation (needed for auto-generated self-signed certs)
83+
RUN apk add --no-cache openssl
84+
85+
# Create certificates directory for auto-generated or mounted certificates
86+
RUN mkdir -p /app/certs && chmod 755 /app/certs
87+
6488
# Set correct permissions
6589
RUN chown -R nextjs:nodejs /app
6690

‎HTTPS_SETUP.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,8 +100,90 @@ If port 3000 is busy, you can change it in `server.js`:
100100
const port = 3001; // or any available port
101101
```
102102

103+
## Option 3: Docker/Production HTTPS Setup
104+
105+
For Docker deployments, HTTPS can be enabled with automatic self-signed certificate generation:
106+
107+
### Quick Setup (Auto-generated Certificates)
108+
109+
1. **Enable HTTPS in your `.env` file:**
110+
```env
111+
ENABLE_HTTPS=true
112+
NEXTAUTH_URL=https://localhost:3000
113+
```
114+
115+
2. **Start your containers:**
116+
```bash
117+
docker-compose up -d
118+
```
119+
120+
That's it! The app will automatically generate self-signed certificates on first startup. Safari will show a security warning, but you can proceed and barcode scanning will work.
121+
122+
### Using Custom Certificates
123+
124+
If you want to provide your own certificates:
125+
126+
1. **Generate certificates** (optional - you can use the provided script):
127+
```bash
128+
# Using the provided script
129+
./scripts/generate-self-signed-cert.sh
130+
131+
# Or manually with OpenSSL
132+
mkdir -p certs
133+
openssl req -x509 -newkey rsa:2048 -keyout certs/key.pem -out certs/cert.pem -days 365 -nodes
134+
```
135+
136+
2. **Mount certificates in docker-compose.yml** (already configured):
137+
```yaml
138+
volumes:
139+
- ./certs:/app/certs:rw
140+
```
141+
142+
3. **Set environment variables** (optional - defaults work):
143+
```env
144+
ENABLE_HTTPS=true
145+
SSL_CERT_PATH=/app/certs/cert.pem
146+
SSL_KEY_PATH=/app/certs/key.pem
147+
```
148+
149+
### Using nginx Proxy (HTTP Backend)
150+
151+
If you're using nginx or another reverse proxy for SSL termination:
152+
153+
1. **Keep HTTPS disabled in the app:**
154+
```env
155+
ENABLE_HTTPS=false
156+
NEXTAUTH_URL=https://yourdomain.com
157+
```
158+
159+
2. **Configure nginx to handle SSL** and proxy to the HTTP backend:
160+
```nginx
161+
server {
162+
listen 443 ssl;
163+
server_name yourdomain.com;
164+
165+
ssl_certificate /path/to/cert.pem;
166+
ssl_certificate_key /path/to/key.pem;
167+
168+
location / {
169+
proxy_pass http://localhost:3000;
170+
proxy_http_version 1.1;
171+
proxy_set_header Upgrade $http_upgrade;
172+
proxy_set_header Connection 'upgrade';
173+
proxy_set_header Host $host;
174+
proxy_set_header X-Real-IP $remote_addr;
175+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
176+
proxy_set_header X-Forwarded-Proto $scheme;
177+
proxy_cache_bypass $http_upgrade;
178+
}
179+
}
180+
```
181+
103182
## Which Option Should I Use?
104183

105184
- **Tunnel (Option 1)**: Best for quick testing, works immediately, no setup
106185
- **Local HTTPS (Option 2)**: Best for ongoing development, faster (no external service), requires one-time setup
186+
- **Docker Auto-generated (Option 3)**: Best for Docker deployments, works out-of-the-box, self-signed certs
187+
- **Docker Custom Certificates (Option 3)**: Best for production Docker deployments with your own certificates
188+
- **nginx Proxy (Option 3)**: Best for production with proper SSL certificates (Let's Encrypt, etc.)
107189

‎docker-compose.prod.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,27 @@
1+
# ============================================================================
2+
# Docker Compose Configuration for Production Deployment (Pre-built Images)
3+
# ============================================================================
4+
# This file is for END USERS who want to deploy Sous Chef using pre-built
5+
# Docker images from Docker Hub. It pulls the image instead of building it.
6+
#
7+
# Use this if you:
8+
# - Just want to run Sous Chef without building from source
9+
# - Want faster deployments and updates
10+
# - Are deploying to production or self-hosting
11+
#
12+
# Usage:
13+
# docker-compose -f docker-compose.prod.yml up -d
14+
#
15+
# The image is configured as: gamerg21/sous-chef:latest
16+
# To use a different image, update the 'image' field in the 'app' service below.
17+
#
18+
# For developers who want to build from source code:
19+
# See docker-compose.yml instead (builds locally using Dockerfile)
20+
#
21+
# Documentation:
22+
# See DEPLOYMENT.md for detailed deployment instructions
23+
# ============================================================================
24+
125
services:
226
# PostgreSQL Database
327
postgres:
@@ -36,6 +60,14 @@ services:
3660
NEXTAUTH_URL: ${NEXTAUTH_URL:-http://localhost:3000}
3761
NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
3862

63+
# HTTPS Configuration (Optional)
64+
# Set ENABLE_HTTPS=true to enable HTTPS mode
65+
# If certificates are not provided, self-signed certs will be auto-generated
66+
ENABLE_HTTPS: ${ENABLE_HTTPS:-true}
67+
SSL_CERT_PATH: ${SSL_CERT_PATH:-/app/certs/cert.pem}
68+
SSL_KEY_PATH: ${SSL_KEY_PATH:-/app/certs/key.pem}
69+
HOSTNAME: ${HOSTNAME:-0.0.0.0}
70+
3971
# SMTP (Optional - for email authentication)
4072
SMTP_HOST: ${SMTP_HOST:-}
4173
SMTP_PORT: ${SMTP_PORT:-587}
@@ -47,6 +79,10 @@ services:
4779
NODE_ENV: production
4880
ports:
4981
- "${APP_PORT:-3000}:3000"
82+
volumes:
83+
# Optional: Mount custom certificates directory
84+
# If not mounted and ENABLE_HTTPS=true, self-signed certs will be auto-generated
85+
- ./certs:/app/certs:rw
5086
depends_on:
5187
postgres:
5288
condition: service_healthy

0 commit comments

Comments
 (0)