Initial commit

Dockerfile

@@ -0,0 +1,62 @@
+# syntax=docker/dockerfile:1.7
+
+# ---------------------------------------------------------------------------
+# Build
+#
+# Nx and the Angular compiler need the whole workspace, so this stage is heavy
+# and is thrown away: only `dist/landing/analog` crosses into the runtime image.
+# ---------------------------------------------------------------------------
+FROM node:22-alpine AS build
+
+WORKDIR /app
+
+ENV NX_DAEMON=false \
+    CI=true \
+    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+
+# Manifests first, so a source-only change does not reinstall the world.
+COPY package.json package-lock.json .npmrc ./
+
+# `@pi/ui` comes from the private Nexus, so the install needs a token — passed
+# as a BuildKit secret rather than a build ARG, which would be readable forever
+# in the image history. The npmrc it lands in is written and removed inside one
+# layer, so it leaves no trace even in this discarded stage.
+RUN --mount=type=secret,id=nexus_token,required=true \
+    sh -eu -c '\
+      printf "//nexus.pireon.dev/repository/npm-releases/:_authToken=%s\n" \
+        "$(cat /run/secrets/nexus_token)" > /tmp/npmrc; \
+      NPM_CONFIG_USERCONFIG=/tmp/npmrc npm ci --no-audit --no-fund; \
+      rm -f /tmp/npmrc'
+
+COPY nx.json tsconfig.base.json eslint.config.mjs ./
+COPY landing ./landing
+
+RUN npx nx build landing
+
+# ---------------------------------------------------------------------------
+# Runtime
+#
+# Nitro vendors its own dependencies into the build output, so there is nothing
+# to install here: the whole server is the 17 MB it copies.
+# ---------------------------------------------------------------------------
+FROM node:22-alpine AS runtime
+
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    PORT=3000 \
+    HOST=0.0.0.0
+
+# `node` already exists in the base image, unprivileged and with no shell login.
+COPY --from=build --chown=node:node /app/dist/landing/analog ./analog
+
+USER node
+
+EXPOSE 3000
+
+# Node rather than curl or wget: neither is in the base image, and adding one
+# for a health check is a package more than the job needs.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "analog/server/index.mjs"]