Gerhard Scheikl
fa457de8ec
Server-side Supabase calls (middleware getUser/refresh, server components, admin client) all egress through the Docker gateway as a single NATed IP and traverse Caddy's per-IP /auth/* rate limiter (8 events/s). A handful of active users saturate that shared bucket, 429ing getUser()/token refresh; the middleware then treats the session as invalid and bounces to /login, while a manual refresh lands under budget and works again. Add SUPABASE_INTERNAL_URL (e.g. http://kong-prod:8000) used only by the server-side clients (middleware, lib/supabase/server.ts, admin getSupabaseAdmin /getSupabaseAnon), falling back to the public URL when unset. Browser clients keep the public URL so real per-user-IP edge rate limiting still applies. Also bake the arg in the Dockerfile/build and make the web-prod network alias durable via WEB_ALIAS (dev sets web-dev) so the dev container can't reclaim the web-prod alias on redeploy.
41 lines
1.4 KiB
Docker
41 lines
1.4 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
FROM node:24.16.0-alpine AS deps
|
|
WORKDIR /app
|
|
RUN apk add --no-cache libc6-compat
|
|
COPY package.json ./
|
|
RUN npm install --no-audit --no-fund --loglevel=error
|
|
|
|
FROM node:24.16.0-alpine AS builder
|
|
WORKDIR /app
|
|
ENV NEXT_TELEMETRY_DISABLED=1
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
COPY . .
|
|
# Build-time public env (baked into client bundle).
|
|
ARG NEXT_PUBLIC_SUPABASE_URL
|
|
ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
|
|
ARG NEXT_PUBLIC_APP_URL
|
|
# Server-only internal Supabase URL (e.g. http://kong-prod:8000). Provided at
|
|
# build time so Next inlines it into the Edge middleware bundle; also read at
|
|
# runtime by the Node server components. Optional — falls back to the public URL.
|
|
ARG SUPABASE_INTERNAL_URL
|
|
ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL \
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY \
|
|
NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL \
|
|
SUPABASE_INTERNAL_URL=$SUPABASE_INTERNAL_URL
|
|
RUN npm run build
|
|
|
|
FROM node:24.16.0-alpine AS runner
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production \
|
|
NEXT_TELEMETRY_DISABLED=1 \
|
|
PORT=3000 \
|
|
HOSTNAME=0.0.0.0
|
|
RUN addgroup -S -g 1001 nodejs && adduser -S -u 1001 -G nodejs nextjs
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
COPY --from=builder --chown=nextjs:nodejs /app/public ./public
|
|
USER nextjs
|
|
EXPOSE 3000
|
|
CMD ["node", "server.js"]
|