Spaces:
Paused
Paused
| # syntax=docker/dockerfile:1 | |
| # | |
| # Image API Scheffin untuk Hugging Face Space. | |
| # | |
| # Space ini publik, jadi kode sumber TIDAK di-push ke sini. Saat build, kode | |
| # di-clone dari repo GitHub privat memakai deploy key (baca-saja) dari secret | |
| # Space GITHUB_DEPLOY_KEY. Commit yang dibangun tertulis di file REVISION, yang | |
| # diisi workflow deploy-api.yml. | |
| # ========================================== | |
| # Tahap 1: clone dan build | |
| # ========================================== | |
| FROM node:24-bookworm-slim AS builder | |
| RUN apt-get update \ | |
| && apt-get install -y --no-install-recommends git openssh-client ca-certificates \ | |
| && rm -rf /var/lib/apt/lists/* | |
| # Kunci host resmi GitHub (api.github.com/meta). Dengan ini koneksi ke server | |
| # palsu tetap ditolak, tanpa perlu StrictHostKeyChecking=no. | |
| RUN mkdir -p /root/.ssh \ | |
| && echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > /root/.ssh/known_hosts | |
| # Sebelum clone: setiap SHA baru memecah cache Docker, jadi clone di bawah | |
| # tidak pernah memakai hasil lama. | |
| COPY REVISION /tmp/REVISION | |
| # Kunci disalin ke file sementara dengan newline di akhir, karena secret yang | |
| # ditempel di Settings sering tanpa newline dan OpenSSH menolaknya ("invalid | |
| # format"). File itu dihapus di RUN yang sama, jadi tidak pernah masuk layer. | |
| RUN --mount=type=secret,id=GITHUB_DEPLOY_KEY,required=true \ | |
| cp /run/secrets/GITHUB_DEPLOY_KEY /tmp/k \ | |
| && echo >> /tmp/k \ | |
| && chmod 600 /tmp/k \ | |
| && GIT_SSH_COMMAND="ssh -i /tmp/k -o IdentitiesOnly=yes" \ | |
| git clone --quiet git@github.com:rasyiq03/Scheffin-App.git /src \ | |
| && rm -f /tmp/k \ | |
| && git -C /src checkout --quiet "$(cat /tmp/REVISION)" \ | |
| && rm -rf /src/.git | |
| WORKDIR /src | |
| # Lockfile hanya ada di root monorepo. | |
| RUN npm ci -w apps/api \ | |
| && npm exec -w apps/api -- prisma generate \ | |
| && npm run build -w apps/api \ | |
| && npm prune --omit=dev -w apps/api \ | |
| && mkdir -p apps/api/node_modules | |
| # ========================================== | |
| # Tahap 2: runtime | |
| # ========================================== | |
| FROM node:24-bookworm-slim | |
| # User "node" bawaan image ber-UID 1000, sesuai yang dipakai Spaces. | |
| COPY --from=builder --chown=node:node /src/node_modules /app/node_modules | |
| COPY --from=builder --chown=node:node /src/apps/api/dist /app/apps/api/dist | |
| COPY --from=builder --chown=node:node /src/apps/api/node_modules /app/apps/api/node_modules | |
| COPY --from=builder --chown=node:node /src/apps/api/package.json /app/apps/api/package.json | |
| COPY --from=builder --chown=node:node /tmp/REVISION /app/REVISION | |
| WORKDIR /app/apps/api | |
| USER node | |
| ENV NODE_ENV=production \ | |
| PORT=7860 | |
| EXPOSE 7860 | |
| # Tanpa `prisma migrate deploy`: migrasi dijalankan manual lewat migrate.yml. | |
| # GIT_SHA dibaca /api/v1/health supaya workflow rilis tahu versi mana yang live. | |
| CMD ["sh", "-c", "GIT_SHA=$(cat /app/REVISION) exec node --no-warnings=MODULE_TYPELESS_PACKAGE_JSON dist/src/main"] | |