monkrb 0.15.0

data/lib/monk/settings.rb

@@ -0,0 +1,151 @@
+require_relative "freeze_hooks"
+
+module Monk
+  # A configuration facility for app-defined values -- MONK_ENV plus
+  # anything else an app needs to configure. Declared once via #configure
+  # (a DSL of #required/#optional key declarations) and read back via #[].
+  # Deliberately separate from Persistence.register/Auth.configure -- see
+  # docs/adr/0006-settings-alongside-persistence-and-auth-config.md.
+  module Settings
+    # MONK_ENV's fixed set of allowed values (CONTEXT.md's MONK_ENV entry).
+    # :monk_env is implicitly declared below -- an app never has to
+    # `required :monk_env` itself -- and its value is validated against
+    # this set at Boot (#freeze_registry!), not before.
+    MONK_ENV_VALUES = %w[development test staging production].freeze
+
+    # Monk::Log's fixed set of allowed levels, ordered least to most severe.
+    # Like :monk_env, :log_level is implicitly declared below and validated
+    # against this set at Boot rather than before. Log::LEVELS aliases this
+    # constant and reads it from worker Ractors on every #enabled? call, so
+    # unlike MONK_ENV_VALUES this needs Ractor.make_shareable, not just
+    # #freeze -- an Array#freeze only freezes the array itself, not the
+    # strings inside, and a worker reading a non-shareable constant raises
+    # Ractor::IsolationError.
+    LOG_LEVEL_VALUES = Ractor.make_shareable(%w[debug info warn error])
+
+    DEFAULT_DECLARATIONS = {
+      monk_env: { required: false, default: "development" },
+      log_level: { required: false, default: "info" },
+    }.freeze
+
+    # The DSL #configure's block runs against. Kept as its own object,
+    # rather than instance_eval'd straight against Settings' singleton
+    # class, so #required/#optional don't leak onto Settings' own public
+    # interface (#[], #configure) inside the block.
+    class DSL
+      def initialize(declarations)
+        @declarations = declarations
+      end
+
+      def required(key)
+        declare(key, required: true, default: nil)
+      end
+
+      def optional(key, default:)
+        declare(key, required: false, default: default)
+      end
+
+      private
+
+      def declare(key, required:, default:)
+        key = key.to_sym
+        raise DuplicateSettingError, "#{key.inspect} is already declared" if @declarations.key?(key)
+
+        @declarations[key] = { required: required, default: default }
+      end
+    end
+
+    class << self
+      def configure(&block)
+        raise SettingsFrozenError, "Settings can't be configured after Boot" if booted?
+
+        DSL.new(declarations).instance_eval(&block)
+      end
+
+      # A key's value. Before Boot, reads ENV live (its uppercased name)
+      # or the declared default -- config/settings.rb and boot-time code
+      # in config.ru need that. After Boot, reads the frozen snapshot
+      # instead: ENV is main-Ractor state, so a per-request read from a
+      # worker Ractor is exactly the hazard docs/persistence-ractor-
+      # connections.md keeps naming. Reading a key nobody declared raises
+      # rather than returning nil, either way.
+      def [](key)
+        key = key.to_sym
+
+        if booted?
+          raise UnknownSettingError, "no setting #{key.inspect} was declared" unless frozen_values.key?(key)
+
+          return frozen_values.fetch(key)
+        end
+
+        declaration = declarations.fetch(key) { raise UnknownSettingError, "no setting #{key.inspect} was declared" }
+        ENV.fetch(env_var_name(key)) { declaration[:default] }
+      end
+
+      def booted?
+        !!@booted
+      end
+
+      # Called from Base#freeze! (Seam B), via Monk.freeze_hooks. Every
+      # required key must be present in ENV or this raises naming it;
+      # every declared key's resolved value is then frozen and made
+      # Ractor.shareable?, so a worker Ractor can read it after Boot
+      # without Ractor::IsolationError.
+      def freeze_registry!
+        values = declarations.each_with_object({}) do |(key, declaration), result|
+          if declaration[:required] && !ENV.key?(env_var_name(key))
+            raise MissingSettingError, "required setting #{key.inspect} (ENV[#{env_var_name(key).inspect}]) is not set"
+          end
+
+          result[key] = ENV.fetch(env_var_name(key)) { declaration[:default] }
+        end
+
+        validate_monk_env!(values[:monk_env])
+        validate_log_level!(values[:log_level])
+
+        @frozen_values = Ractor.make_shareable(values)
+        @booted = true
+      end
+
+      # Test-only.
+      def reset!
+        @declarations = DEFAULT_DECLARATIONS.dup
+        @frozen_values = nil
+        @booted = false
+      end
+
+      private
+
+      def validate_monk_env!(value)
+        return if MONK_ENV_VALUES.include?(value)
+
+        raise InvalidMonkEnvError, "MONK_ENV must be one of #{MONK_ENV_VALUES.join(", ")}, got #{value.inspect}"
+      end
+
+      def validate_log_level!(value)
+        return if LOG_LEVEL_VALUES.include?(value)
+
+        raise InvalidLogLevelError, "LOG_LEVEL must be one of #{LOG_LEVEL_VALUES.join(", ")}, got #{value.inspect}"
+      end
+
+      def declarations
+        @declarations ||= DEFAULT_DECLARATIONS.dup
+      end
+
+      # A plain reader, not `@frozen_values ||= ...`: freeze_registry!
+      # always sets this alongside @booted, and a lazy write here would
+      # be a write to a module ivar from whichever Ractor first reads it
+      # after Boot -- exactly the isolation error this method exists to
+      # avoid.
+      def frozen_values
+        @frozen_values
+      end
+
+      def env_var_name(key)
+        key.to_s.upcase
+      end
+    end
+
+    Monk.freeze_hooks << self
+  end
+end

data/lib/monk/state_ractor.rb

@@ -0,0 +1,45 @@
+module Monk
+  class StateRactor
+    def initialize(initial_value)
+      @ractor = Ractor.new(initial_value) do |value|
+        loop do
+          op, arg, reply_port = Ractor.receive
+          case op
+          when :value
+            reply_port.send(value)
+          when :update
+            value = arg.call(value)
+            reply_port.send(value)
+          end
+        end
+      end
+      freeze
+    end
+
+    def value
+      ask(:value)
+    end
+
+    def update(&block)
+      begin
+        shareable_block = Ractor.make_shareable(block)
+      rescue ArgumentError, Ractor::IsolationError => e
+        raise UnshareableBlockError,
+          "StateRactor#update block is not Ractor-shareable: #{e.message} " \
+          "(build it where self is shareable, e.g. at app-definition time, not inline in a route handler)"
+      end
+
+      ask(:update, shareable_block)
+    end
+
+    private
+
+    def ask(op, arg = nil)
+      reply_port = Ractor::Port.new
+      @ractor.send([op, arg, reply_port])
+      reply_port.receive
+    ensure
+      reply_port&.close
+    end
+  end
+end

data/lib/monk/templates/auth/config/auth.rb

@@ -0,0 +1,28 @@
+require "monk"
+require "monk/auth"
+require_relative "persistence"
+
+# config/settings.rb already declares public_url -- the trusted origin for
+# the magic link your own login route builds (e.g.
+# "#{Monk::Settings[:public_url]}/auth/callback/#{token}"), see its comment
+# there and auth.md's "Sending the magic link".
+
+# Sends the magic link once you have real delivery (email, SMS, ...) --
+# a module constant, not a lambda inline in Auth.configure below, since
+# self at this file's top level isn't Ractor-shareable (same constraint as
+# Monk::Live.authorize blocks). Until this is wired up for real,
+# Monk::Auth.deliver_link falls back to Monk::Auth.log_dev_link in
+# development and raises everywhere else -- see docs/guides/auth.md.
+module AppMailer
+  # DELIVER = ->(email:, link:, token:) { YourMailer.magic_link(email, link) }
+end
+
+Monk::Auth.configure(
+  db_name: :primary,
+  secret: ENV.fetch("AUTH_SECRET"),
+  login_ttl: 600,          # seconds a login token stays redeemable
+  session_ttl: 1_209_600,  # seconds a session stays valid (14 days)
+  redirect_allowlist: [],  # paths request_login(redirect_to:) is allowed to target
+  secure: !Monk.env.development?, # Secure cookie flag; off in dev so plain-http testing works (Safari drops it)
+  # deliver: AppMailer::DELIVER,
+)

data/lib/monk/templates/auth/db/migrate/00000000000001_create_auth_tables.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE sessions;
+DROP TABLE login_tokens;

data/lib/monk/templates/auth/db/migrate/00000000000001_create_auth_tables.up.sql

@@ -0,0 +1,18 @@
+CREATE TABLE login_tokens (
+  id BIGSERIAL PRIMARY KEY,
+  email TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  redirect_to TEXT,
+  expires_at TIMESTAMPTZ NOT NULL,
+  used_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE sessions (
+  id BIGSERIAL PRIMARY KEY,
+  subject TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  expires_at TIMESTAMPTZ NOT NULL,
+  revoked_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);

data/lib/monk/templates/base/.dockerignore

@@ -0,0 +1,5 @@
+.git
+log/
+.env
+.env.*
+!.env.example

data/lib/monk/templates/base/.gitignore

@@ -0,0 +1,4 @@
+/log/
+/.env
+/.env.*
+!/.env.example

data/lib/monk/templates/base/.ruby-version

@@ -0,0 +1 @@
+4.0.6

data/lib/monk/templates/base/Dockerfile

@@ -0,0 +1,28 @@
+# Two-stage build: the builder resolves and installs gems, the final image
+# only keeps the installed bundle plus the app -- no compiler, no gem
+# cache, in the image that actually runs. No system packages needed here:
+# kino ships as precompiled platform gems, and a plain `bundle install`
+# (Gemfile.lock committed) already resolves every compatible platform, not
+# just the machine that ran it -- nothing to add by hand before building on
+# a different host (docs/guides/deploying.md, "Before the first build").
+# monk/rackup/webrick are pure Ruby. The --postgres/--auth scaffold
+# overrides this file to add libpq for the pg gem's native extension.
+FROM ruby:4.0-slim AS builder
+WORKDIR /app
+
+COPY Gemfile Gemfile.lock* ./
+RUN bundle install
+
+FROM ruby:4.0-slim
+WORKDIR /app
+
+COPY --from=builder /usr/local/bundle /usr/local/bundle
+COPY . .
+
+# Matches bin/server's own default (PORT overrides both, e.g. on a
+# platform that assigns its own). bin/websocket_server (WS_PORT default
+# 9293) is a separate process/deploy unit -- run this same image with
+# `bin/websocket_server` as the command instead of publishing another
+# port from this Dockerfile -- see docs/guides/deploying.md.
+EXPOSE 9292
+CMD ["bin/server", "--bind", "0.0.0.0"]

data/lib/monk/templates/base/Gemfile

@@ -0,0 +1,7 @@
+source "https://rubygems.org"
+
+gem "monkrb", require: "monk"
+gem "rackup"
+gem "webrick"
+gem "kino"
+# gem "dotenv" # uncomment to load a local .env file (config/settings.rb)

data/lib/monk/templates/base/bin/server

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+exec bundle exec kino -p "${PORT:-9292}" "$@" config.ru

data/lib/monk/templates/base/bin/websocket_server

@@ -0,0 +1,62 @@
+#!/usr/bin/env ruby
+require "bundler/setup"
+require_relative "../config/settings"
+
+# config/auth.rb only exists if this app was scaffolded with --auth -- a
+# missing file is a harmless no-op, the same way config/settings.rb treats
+# a missing dotenv gem. Present or not, it's what decides whether this
+# process authenticates connections below.
+begin
+  require_relative "../config/auth"
+rescue LoadError
+end
+
+require "monk/websocket"
+
+# A single broadcast chat channel: every connection subscribes to :chat,
+# and whatever one connection sends is broadcast to everyone on it
+# (including itself), prefixed with the authenticated subject when there
+# is one.
+#
+# Defined inside a module, not at this script's own top level -- self at a
+# script's top level is the main object, which is *not* Ractor-shareable,
+# so a proc built there fails Server#run's Ractor.make_shareable check.
+# Module bodies are always shareable, same as StateRactor#update's block
+# requirement.
+module ChatServer
+  # REDIS_URL set (by an app scaffolded with --redis, or by hand) wraps the
+  # registry so :chat also fans out to every other Monk::WebSocket::Server
+  # process sharing that Redis -- unset, it's in-process only. Either way
+  # the app code above never has to know which: RedisFanout has the exact
+  # same #register/#unregister/#count/#broadcast interface as Registry.
+  REGISTRY =
+    if (redis_url = ENV["REDIS_URL"])
+      require "monk/websocket/redis_fanout"
+      Monk::WebSocket::RedisFanout.new(Monk::WebSocket::Registry.new, redis_url: redis_url)
+    else
+      Monk::WebSocket::Registry.new
+    end
+
+  HANDLER = proc do |connection|
+    connection.subscribe(REGISTRY, :chat)
+    loop do
+      message = connection.read
+      break unless message
+
+      REGISTRY.broadcast(:chat, "#{connection.subject || "guest"}: #{message}")
+    end
+  end
+end
+
+authenticate = defined?(Monk::Auth) && !!Monk::Auth.config
+port = ENV.fetch("WS_PORT", "9293").to_i
+# Defaults to public_url (config/settings.rb) so one PUBLIC_URL env var
+# keeps this in sync with the app's actual origin instead of two vars
+# drifting apart; set WS_ALLOWED_ORIGINS directly for anything more, e.g.
+# more than one origin (comma-separated).
+allowed_origins = ENV.fetch("WS_ALLOWED_ORIGINS", Monk::Settings[:public_url]).split(",")
+
+server = Monk::WebSocket::Server.new(port: port, authenticate: authenticate, allowed_origins: allowed_origins)
+puts "Monk::WebSocket::Server listening on ws://0.0.0.0:#{port} " \
+  "(authenticate: #{authenticate}, redis fan-out: #{ENV["REDIS_URL"] ? "on" : "off"})"
+server.run(&ChatServer::HANDLER)

data/lib/monk/templates/base/config/settings.rb

@@ -0,0 +1,30 @@
+# Loads a local .env file in development, if the app has uncommented the
+# dotenv gem in its Gemfile (see the commented-out line there) and added
+# a .env file of its own. A missing .env, or the gem not being in the
+# bundle at all, is a harmless no-op either way -- production deploys
+# get their env vars from the hosting platform directly, not from here.
+begin
+  require "dotenv/load"
+rescue LoadError
+end
+
+require "monk"
+
+Monk::Settings.configure do
+  # This app's own public origin -- the one trusted source for building an
+  # absolute URL back to itself (a magic link, the WebSocket URL a browser
+  # should open), instead of request headers like X-Forwarded-Proto/Host,
+  # which any direct client can spoof. Declared here, not in config/auth.rb
+  # or config/live.rb, since both read it: auth.md's "Sending the magic
+  # link" and live.md's `live_ws_url`. Set to your real https:// origin
+  # outside development.
+  optional :public_url, default: "http://localhost:9292"
+end
+
+# Declare more of the app's own settings here, read anywhere via
+# Monk::Settings[:key] or, per-request, Context#settings[:key]:
+#
+# Monk::Settings.configure do
+#   required :api_key
+#   optional :port, default: "9292"
+# end

data/lib/monk/templates/base/config.ru

@@ -0,0 +1,13 @@
+require_relative "config/settings"
+
+class App < Monk::Base
+  views "views"
+  layout "layouts/app"
+  assets "public"
+
+  get("/") { @title = "App"; render "index" }
+  get("/hello") { "hello from monk" }
+  get("/api/hello") { json(message: "hello from monk") }
+end
+
+run Monk.boot(App)

data/lib/monk/templates/base/public/css/app.css

@@ -0,0 +1,17 @@
+:root { --bg: #fbfbfa; --fg: #1c1c1a; --muted: #6b6b66; }
+
+@media (prefers-color-scheme: dark) {
+  :root { --bg: #14140f; --fg: #eceae2; --muted: #97958c; }
+}
+
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--fg);
+  font: 16px/1.6 system-ui, -apple-system, "Segoe UI", sans-serif;
+}
+
+main { max-width: 42rem; margin: 0 auto; padding: 3rem 1.5rem; }
+h1 { font-size: 2rem; letter-spacing: -0.02em; margin: 0 0 0.5rem; }
+p { color: var(--muted); }
+code { font-family: ui-monospace, "SF Mono", Menlo, monospace; }

data/lib/monk/templates/base/public/js/app.js

@@ -0,0 +1,5 @@
+// Served as-is and loaded as an ES module -- no build step. Import your
+// own files by relative path with a real extension
+// (import { x } from "./x.js"), and anything third-party through the
+// import map in views/layouts/app.erb.
+console.log("monk");

data/lib/monk/templates/base/views/index.erb

@@ -0,0 +1,6 @@
+<h1>It works</h1>
+<p>
+  Edit <code>views/index.erb</code> and restart the server to see this
+  change. Templates compile once at boot; <code>&lt;%= %&gt;</code>
+  escapes by default, <code>raw(...)</code> opts out.
+</p>

data/lib/monk/templates/base/views/layouts/app.erb

@@ -0,0 +1,18 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title><%= @title %></title>
+    <link rel="stylesheet" href="<%= asset_path "/css/app.css" %>">
+    <%# No bundler, no node_modules: third-party JS is a bare specifier
+        mapped here to a file served out of public/. %>
+    <script type="importmap">
+      { "imports": {} }
+    </script>
+    <script type="module" src="<%= asset_path "/js/app.js" %>"></script>
+  </head>
+  <body>
+    <main><%= yield %></main>
+  </body>
+</html>

data/lib/monk/templates/live/bin/websocket_server

@@ -0,0 +1,30 @@
+#!/usr/bin/env ruby
+require "bundler/setup"
+require_relative "../config/settings"
+
+# config/auth.rb only exists if this app was scaffolded with --auth -- a
+# missing file is a harmless no-op, the same way config/settings.rb treats
+# a missing dotenv gem. Present or not, it's what decides whether this
+# process authenticates connections below.
+begin
+  require_relative "../config/auth"
+rescue LoadError
+end
+
+# Monk::Live: the browsers' sockets end here. The handler takes their
+# subscribe/unsubscribe messages, checks each topic against the rules in
+# config/live.rb, and relays whatever config.ru's process publishes over
+# Redis.
+require_relative "../config/live"
+
+authenticate = defined?(Monk::Auth) && !!Monk::Auth.config
+port = ENV.fetch("WS_PORT", "9293").to_i
+# Defaults to public_url (config/settings.rb) so one PUBLIC_URL env var
+# keeps this in sync with the app's actual origin instead of two vars
+# drifting apart; set WS_ALLOWED_ORIGINS directly for anything more, e.g.
+# more than one origin (comma-separated).
+allowed_origins = ENV.fetch("WS_ALLOWED_ORIGINS", Monk::Settings[:public_url]).split(",")
+
+server = Monk::WebSocket::Server.new(port: port, authenticate: authenticate, allowed_origins: allowed_origins)
+puts "Monk::Live WebSocket server listening on ws://0.0.0.0:#{port} (authenticate: #{authenticate})"
+server.run(&Monk::Live::HANDLER)

data/lib/monk/templates/live/config/live.rb

@@ -0,0 +1,47 @@
+# Monk::Live wiring, required by both processes: config.ru (this app
+# publishes updates, e.g. from a route) and bin/websocket_server (the browsers'
+# sockets terminate there and are handed the updates).
+#
+# They are separate processes, so Redis is what carries a publish from one to
+# the other -- REDIS_URL (set in .env by `monk new --live`) is required.
+require_relative "settings"
+require "monk/live"
+require "monk/websocket/redis_fanout"
+
+# Where the browser opens its WebSocket (read by the layout). In
+# development there's no reverse proxy in front, so this is the direct WS
+# port; outside development it defaults to a /ws path under public_url
+# (config/settings.rb) -- matching the path-based proxy routing
+# docs/guides/deploying.md's "Adding Monk::WebSocket" section sets up, so
+# setting PUBLIC_URL alone keeps this in sync instead of two env vars
+# drifting apart. Override with LIVE_WS_URL directly if your setup doesn't
+# fit that shape.
+default_live_ws_url =
+  if Monk.env.development?
+    "ws://localhost:9293"
+  else
+    Monk::Settings[:public_url].sub(/\Ahttps:\/\//, "wss://").sub(/\Ahttp:\/\//, "ws://") + "/ws"
+  end
+
+Monk::Settings.configure do
+  optional :live_ws_url, default: default_live_ws_url
+end
+
+redis_url = ENV["REDIS_URL"] or raise "Monk::Live needs REDIS_URL: bin/server and bin/websocket_server " \
+  "are separate processes, and Redis is how an update published in one reaches a socket in the other"
+
+Monk::Live.configure(
+  registry: Monk::WebSocket::RedisFanout.new(Monk::WebSocket::Registry.new, redis_url: redis_url),
+)
+
+# Who may subscribe to what. Nothing is allowed unless a rule says so, and an
+# anonymous connection is denied unless the rule opts in with `anonymous: true`.
+# The rule blocks live in a module because they have to be Ractor-shareable
+# (self at the top of this file is not).
+module AppLive
+  # The demo counter is public. A real rule looks at who is asking:
+  #   proc { |subject, topic| topic == "contacts:#{subject}" }
+  PUBLIC = proc { |_subject, _topic| true }
+end
+
+Monk::Live.authorize("hits", anonymous: true, &AppLive::PUBLIC)

data/lib/monk/templates/live/config.ru

@@ -0,0 +1,27 @@
+require_relative "config/settings"
+require_relative "config/live"
+
+class App < Monk::Base
+  views "views"
+  layout "layouts/app"
+  assets "public"
+
+  # State shared across requests lives in a StateRactor; the update block is
+  # built here, where self is shareable, not inline in the route.
+  hits = Monk::StateRactor.new(0)
+  increment = Ractor.make_shareable(proc { |n| n + 1 })
+
+  get("/") { @title = "App"; render "index", hits: hits.value }
+
+  # Change state, then tell every open page that shows it. Monk::Live.patch
+  # renders the partial once and pushes it to the "hits" topic's subscribers.
+  post("/hit") do
+    Monk::Live.patch("hits", to: "#hits", partial: "live/_hits", hits: hits.update(&increment))
+    redirect "/"
+  end
+
+  get("/hello") { "hello from monk" }
+  get("/api/hello") { json(message: "hello from monk") }
+end
+
+run Monk.boot(App)

data/lib/monk/templates/live/views/index.erb

@@ -0,0 +1,18 @@
+<h1>Monk::Live</h1>
+<p>
+  Open this page in two tabs and press the button in one: the counter in the
+  other updates by itself. The server pushes the new HTML over a WebSocket;
+  there is no polling and no page JavaScript of your own.
+</p>
+
+<%# live_topic makes this element's page subscribe to the "hits" topic. %>
+<p <%= live_topic "hits" %>>Hits so far: <%= render "live/_hits", hits: locals[:hits], layout: false %></p>
+
+<form method="post" action="/hit"><button>+1</button></form>
+
+<p>
+  The pieces: <code>live_topic</code> in this view, the partial
+  <code>views/live/_hits.erb</code>, <code>Monk::Live.patch</code> in
+  <code>POST /hit</code> (<code>config.ru</code>), and the rules and Redis
+  wiring in <code>config/live.rb</code>.
+</p>

data/lib/monk/templates/live/views/live/_hits.erb

@@ -0,0 +1 @@
+<strong id="hits"><%= locals[:hits] %></strong>

data/lib/monk/templates/postgres/Dockerfile

@@ -0,0 +1,30 @@
+# Same shape as the base Dockerfile, plus libpq: the pg gem's native
+# extension needs libpq-dev (headers) to compile in the builder stage and
+# libpq5 (the runtime lib alone, no headers) in the final image.
+FROM ruby:4.0-slim AS builder
+WORKDIR /app
+
+RUN apt-get update -qq \
+    && apt-get install -y --no-install-recommends build-essential libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY Gemfile Gemfile.lock* ./
+RUN bundle install
+
+FROM ruby:4.0-slim
+WORKDIR /app
+
+RUN apt-get update -qq \
+    && apt-get install -y --no-install-recommends libpq5 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/local/bundle /usr/local/bundle
+COPY . .
+
+# Matches bin/server's own default (PORT overrides both, e.g. on a
+# platform that assigns its own). bin/websocket_server (WS_PORT default
+# 9293) is a separate process/deploy unit -- run this same image with
+# `bin/websocket_server` as the command instead of publishing another
+# port from this Dockerfile -- see docs/guides/deploying.md.
+EXPOSE 9292
+CMD ["bin/server", "--bind", "0.0.0.0"]

data/lib/monk/templates/postgres/Gemfile.extra

@@ -0,0 +1,2 @@
+gem "pg"
+gem "irb"

data/lib/monk/templates/postgres/bin/console

@@ -0,0 +1,7 @@
+#!/usr/bin/env ruby
+require "bundler/setup"
+require_relative "../config/settings"
+require_relative "../config/persistence"
+require "irb"
+
+IRB.start(__FILE__)