Dockerfile

# Vite bakes VITE_* values into the bundle at build time, not at run time. They
# have to be present while `npm run build` runs, which is why they arrive as
# build args and why every installation builds its own image instead of pulling
# a ready-made one. The anon key ending up in the bundle is expected — see the
# note in README.md. Row Level Security is what protects the data.
FROM node:20-alpine AS build

ARG VITE_SUPABASE_URL
ARG VITE_SUPABASE_ANON_KEY
ARG VITE_OWNER_EMAIL
ENV VITE_SUPABASE_URL=$VITE_SUPABASE_URL \
    VITE_SUPABASE_ANON_KEY=$VITE_SUPABASE_ANON_KEY \
    VITE_OWNER_EMAIL=$VITE_OWNER_EMAIL

# Fail here rather than shipping an image that only breaks in the browser: with
# the first two missing supabaseClient.ts throws on startup, and with the third
# missing every account lands on "Access Denied", owner included.
RUN test -n "$VITE_SUPABASE_URL" -a -n "$VITE_SUPABASE_ANON_KEY" -a -n "$VITE_OWNER_EMAIL" \
    || ( echo "" \
      && echo "Missing build args. All three are required:" \
      && echo "  VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY, VITE_OWNER_EMAIL" \
      && echo "Put them in a .env file next to docker-compose.yml (see .env.example)." \
      && echo "" && exit 1 )

WORKDIR /app

# Copied before the source so the dependency layer survives code changes.
COPY package.json package-lock.json ./
RUN npm ci

COPY . .
RUN npm run build

# The result is a folder of static files, so nothing heavier than nginx is
# needed to serve it. There is no server-side runtime: the backend is Supabase.
FROM nginx:alpine AS serve

COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
COPY --from=build /app/dist /usr/share/nginx/html

EXPOSE 80