make app production-ready

.dockerignore

@@ -1,3 +1,16 @@
 .cache
 build
 node_modules
+
+# Local-only files that must NOT be baked into the production image.
+.env
+.env.*
+!.env.production.example
+prisma/dev.sqlite
+prisma/dev.sqlite-journal
+.shopify
+.git
+.github
+*.log
+extensions/*/dist
+

app/shopify.server.ts

@@ -15,7 +15,7 @@ const shopify = shopifyApp({
   appUrl: process.env.SHOPIFY_APP_URL || "",
   authPathPrefix: "/auth",
   sessionStorage: new PrismaSessionStorage(prisma),
-  distribution: AppDistribution.AppStore,
+  distribution: AppDistribution.SingleMerchant,
   future: {
     expiringOfflineAccessTokens: true,
   },

deploy/Caddyfile.snippet

@@ -0,0 +1,8 @@
+# Append to your existing Caddyfile (or include via `import`).
+# DNS A/AAAA record for invoice-app.linumiq.com must point to this server first,
+# otherwise Caddy will fail to obtain a Let's Encrypt certificate.
+
+invoice-app.linumiq.com {
+	encode zstd gzip
+	reverse_proxy 127.0.0.1:3000
+}

docker-compose.yml

@@ -0,0 +1,28 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: linumiq-invoice:latest
+    container_name: linumiq-invoice
+    restart: unless-stopped
+    env_file:
+      - .env.production
+    environment:
+      # SQLite file lives on a named volume so it survives image rebuilds.
+      DATABASE_URL: "file:/data/prod.sqlite"
+      NODE_ENV: production
+      PORT: "3000"
+    volumes:
+      - invoice-data:/data
+    # Bind to loopback only — Caddy on the host terminates TLS and reverse-proxies.
+    ports:
+      - "127.0.0.1:3000:3000"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/healthz", "||", "exit", "0"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+volumes:
+  invoice-data:

prisma/schema.prisma

@@ -10,7 +10,7 @@ generator client {
 // See https://www.prisma.io/docs/orm/reference/prisma-schema-reference#string for more information
 datasource db {
   provider = "sqlite"
-  url      = "file:dev.sqlite"
+  url      = env("DATABASE_URL")
 }
 
 model Session {

shopify.app.toml

@@ -1,7 +1,7 @@
 # Learn more about configuring your app at https://shopify.dev/docs/apps/tools/cli/configuration
 
 client_id = "fbc263e6cc28e8de031878d2a0f17444"
-application_url = "https://example.com"
+application_url = "https://invoice-app.linumiq.com"
 embedded = true
 name = "linumiq-invoice"
 
@@ -32,7 +32,11 @@ api_version = "2026-07"
   topics = [ "orders/updated" ]
 
 [auth]
-redirect_urls = [ "https://example.com/api/auth" ]
+redirect_urls = [
+  "https://invoice-app.linumiq.com/auth/callback",
+  "https://invoice-app.linumiq.com/auth/shopify/callback",
+  "https://invoice-app.linumiq.com/api/auth/callback",
+]
 
 [build]
 include_config_on_deploy = true