chore(iios): production Dockerfile + migrate entrypoint + env/secrets contract

Adds a multi-stage Dockerfile for iios-service (build → pnpm deploy prune → slim non-root runtime), a docker-entrypoint that runs `prisma migrate deploy` then starts the server as PID 1, a .dockerignore, a fully-commented .env.example config contract, and docs/DEPLOYMENT.md (topology, scaling, release strategy, prod-readiness gaps). Moves prisma to dependencies so the CLI ships in the prod bundle. Image builds, migrates, and serves /health 200. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-03 19:19:13 +05:30
parent 5bd1f646ca
commit a520b26398
7 changed files with 241 additions and 4 deletions
@@ -0,0 +1,54 @@
+# syntax=docker/dockerfile:1
+# Production image for @insignia/iios-service (the single IIOS backend).
+# Build context MUST be the monorepo ROOT (it needs the workspace + lockfile):
+#   docker build -f packages/iios-service/Dockerfile -t iios-service:latest .
+#
+# Multi-stage: (1) build the service + its workspace deps and prune to a
+# self-contained prod bundle via `pnpm deploy`; (2) a slim runtime that only
+# carries that bundle. Migrations run at container start (see docker-entrypoint.sh).
+
+ARG NODE_VERSION=22-bookworm-slim
+ARG PNPM_VERSION=10.6.2
+
+# ── build ───────────────────────────────────────────────────────────────────
+FROM node:${NODE_VERSION} AS build
+ARG PNPM_VERSION
+ENV PNPM_HOME=/pnpm PATH=/pnpm:$PATH
+# openssl + ca-certificates are required by Prisma's engine on debian-slim.
+RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate
+
+WORKDIR /repo
+COPY . .
+
+# Full install (needs devDeps to compile), then build ONLY the service + its
+# workspace dependencies, generate the Prisma client, and emit a pruned prod bundle.
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm install --frozen-lockfile
+# Generate the Prisma client BEFORE compiling — nest build (tsc) needs its types,
+# otherwise Prisma results are `any` and noImplicitAny fails the build.
+RUN pnpm --filter @insignia/iios-service exec prisma generate \
+ && pnpm --filter "@insignia/iios-service..." build \
+ && pnpm --filter @insignia/iios-service --prod --legacy deploy /app
+
+# ── runtime ──────────────────────────────────────────────────────────────────
+FROM node:${NODE_VERSION} AS runtime
+ENV NODE_ENV=production
+# Prisma engine needs openssl at runtime too.
+RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY --from=build /app ./
+# Regenerate the Prisma client against the final filesystem (deterministic).
+RUN node_modules/.bin/prisma generate
+
+# Run as the built-in non-root `node` user.
+RUN chmod +x docker-entrypoint.sh && chown -R node:node /app
+USER node
+
+EXPOSE 3200
+ENV PORT=3200
+# migrate deploy → start; see docker-entrypoint.sh.
+ENTRYPOINT ["./docker-entrypoint.sh"]