@next-friday/create-app 2.0.0 → 2.1.1

package/templates/turborepo/README.md

@@ -0,0 +1,114 @@
+# next-friday-template-turborepo
+
+Next Friday starter for a Turborepo workspace. `apps/app` is a Next.js site on port 3000. `apps/backoffice` is a Payload CMS on port 3001. The backoffice API is REST at `/api`.
+
+## Getting started
+
+```sh
+npm install --global pnpm
+pnpm install
+pnpm dev
+```
+
+The CLI created `.env` from `.env.example` and set `PAYLOAD_SECRET` to a random secret. Before `pnpm dev`, set in `.env`:
+
+- `DATABASE_URL`: a PostgreSQL database.
+- `APP_URL`: the URL you open the backoffice at, such as `http://localhost:3001`.
+- `PAYLOAD_SECRET`, only if you recreate `.env` from `.env.example`: generate one with `openssl rand -hex 32`.
+
+Then open `http://localhost:3000` for the site and `http://localhost:3001/admin` to create the first user.
+
+**Warning:** until the first user exists, anyone who can reach the backoffice `/admin` can create it. Create the first user in each deployed environment right after its first deploy, before you share the URL.
+
+In development, Payload applies collection changes to the database directly. In production, the server applies the migrations in `apps/backoffice/src/migrations/` when it starts.
+
+## After creating a project from this template
+
+1. Install gitleaks and jq (see [CONTRIBUTING.md](CONTRIBUTING.md)). Make the first commit on `main` and push it. The Git hooks allow only this first commit and push on `main`; work on branches after that.
+
+   ```sh
+   git add --all
+   git commit -m "chore(repo): start from template"
+   git push --set-upstream origin main
+   ```
+
+2. Add your team as the owner of every file in `.github/CODEOWNERS`, and replace the owner placeholder in `.github/zizmor.yml`.
+3. Replace the template's description and owner: `package.json#description`, `repository.url`, and `author`, and the `Next Friday Next.js template` text in `apps/app/app/layout.tsx`, `apps/app/app/page.tsx`, and their tests, and the `Next Friday Payload template` text in `apps/backoffice/src/app/(frontend)/layout.tsx`, `apps/backoffice/src/app/(frontend)/page.tsx`, and their tests. Change `license` from `UNLICENSED` if the project is open source.
+4. In the repository settings:
+   - **Actions → General → Workflow permissions:** select **Read repository contents and packages permissions**. Every workflow requests the extra permissions it needs.
+   - **Advanced Security:** enable private vulnerability reporting, Dependabot alerts, Dependabot security updates, secret scanning, and push protection. `SECURITY.md` sends reporters to private vulnerability reporting.
+   - **Cursor Bugbot:** enable the repository at [Bugbot](https://cursor.com/automations/from-cursor/bugbot). Bugbot reviews pull requests against the rules linked from `.cursor/BUGBOT.md`.
+   - **Rules → Rulesets:** protect `main` with squash merges only, a linear history, no force pushes or deletion, and the required checks `All Checks` and `Validate pull request title`. Rulesets in a private repository need GitHub Pro, Team, or Enterprise; on GitHub Free, make the repository public or upgrade.
+   - Create the `needs triage` label, which the issue forms apply: `gh label create "needs triage"`.
+
+## Scripts
+
+| Script                    | Purpose                                                                                          |
+| :------------------------ | :----------------------------------------------------------------------------------------------- |
+| `pnpm dev`                | Start the Next.js app on port 3000 and the Payload backoffice on port 3001                       |
+| `pnpm build`              | Build both apps for production                                                                   |
+| `pnpm start`              | Serve both standalone production builds after `pnpm build`                                       |
+| `pnpm test`               | Run unit tests in both apps                                                                      |
+| `pnpm test:e2e`           | Run Playwright end-to-end tests in both apps. The backoffice uses the database in `DATABASE_URL` |
+| `pnpm generate:types`     | Regenerate `apps/backoffice/src/payload-types.ts` after a collection change                      |
+| `pnpm generate:importmap` | Regenerate the admin import map after adding a custom component                                  |
+| `pnpm migrate:create`     | Create a migration from collection changes, for example `pnpm migrate:create add-posts`          |
+| `pnpm migrate`            | Apply pending migrations to the database in `DATABASE_URL`                                       |
+| `pnpm check`              | Run the static checks and the unit tests for changed code (the `pre-push` hook)                  |
+| `pnpm verify`             | Run the static checks and all unit tests with coverage                                           |
+
+CI also runs the build, the end-to-end tests, the container image scans, and the security scans. Pull requests run Turborepo with `--affected` against the base branch, so only packages that changed are typed, tested, built, and scanned. Pushes to `main` and the weekly schedule still run every app. Patch coverage runs only for apps that produced a coverage file.
+
+To reuse task output across CI runs, create a Vercel team, add the repository variable `TURBO_TEAM`, and follow [Turborepo on GitHub Actions](https://turborepo.dev/docs/guides/ci-vendors/github-actions) to allow OIDC. The workflow exchanges GitHub OIDC for a short-lived Remote Cache token. If OIDC is unavailable, set the `TURBO_TOKEN` secret instead. Leave both unset to run without a Remote Cache.
+
+## Container
+
+Each app has a Dockerfile. Build both from the workspace root. The images run as the `node` user. The app listens on `PORT`, or 3000 when it is unset. The backoffice listens on `PORT`, or 3000 when it is unset, and needs `DATABASE_URL`, `PAYLOAD_SECRET`, and `APP_URL`.
+
+```sh
+docker build --file apps/app/Dockerfile --tag app .
+docker build --file apps/backoffice/Dockerfile --tag backoffice .
+docker run --publish 3000:3000 app
+docker run --publish 3001:3001 --env PORT=3001 --env DATABASE_URL --env PAYLOAD_SECRET --env APP_URL backoffice
+```
+
+Uploaded images, up to 10 MB each, are written to the backoffice container filesystem, which a redeploy discards. Add a Payload storage adapter, for example `@payloadcms/storage-s3`, before storing media in production.
+
+On Vercel, deploy an app without its image. The Next.js preset takes precedence over the Dockerfile.
+
+## Deploy
+
+`.github/workflows/deploy.yml` deploys both apps and promotes one commit through `dev`, `uat`, and `prod`. `railway.json` sets the Railway health check to `/health`. Create one Railway service per app, with that service's Dockerfile path set to `apps/app/Dockerfile` or `apps/backoffice/Dockerfile`. The workflow stays off until you configure it:
+
+1. In Railway, create a project with one service for each app, one PostgreSQL database for the backoffice, and the environments `dev`, `uat`, and `prod`. The workflow passes these names to `railway up --environment`. In each backoffice environment, set the service variables:
+   - `DATABASE_URL` to `${{Postgres.DATABASE_URL}}`;
+   - `PAYLOAD_SECRET` to a separate long random string;
+   - `APP_URL` to that environment's public backoffice `https://` URL.
+
+   Create one project token per environment under **Project Settings → Tokens**. CI tests against PostgreSQL 17; change the image in `ci.yml` if the database runs another major version.
+
+2. In GitHub, create the `dev`, `uat`, and `prod` environments under **Settings → Environments**, and add to each:
+   - the `RAILWAY_TOKEN` secret: that environment's project token;
+   - the `RAILWAY_SERVICE_APP` variable: the Next.js service name;
+   - the `RAILWAY_SERVICE_BACKOFFICE` variable: the Payload service name;
+   - the `APP_URL` variable: the public Next.js `https://` URL;
+   - the `BACKOFFICE_URL` variable: the public backoffice `https://` URL.
+
+   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+
+3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`. The workflow compares the commit with the last GitHub deployment to that environment and runs `railway up` only for services whose packages changed. A promotion through `uat` or `prod` uses the same comparison against the commit last deployed there, so several commits still ship every changed service. The first deploy to an environment ships both services.
+4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health` on each service it uploaded.
+
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
+## Mobile app
+
+The template does not ship an Expo app. Add one under `apps/mobile` when you need it:
+
+1. Create the app from the workspace root with `pnpm create expo-app@latest apps/mobile`, then add `packages/*` workspace packages as you share code. Keep `eas.json` and `credentials.json` inside `apps/mobile` and run the EAS CLI from that directory ([Expo: Build with monorepos](https://docs.expo.dev/build-reference/build-with-monorepos/)).
+2. Use `@expo/fingerprint` with `expo-github-action/fingerprint` so a pull request requests a native build only when the native layer changed ([Expo fingerprint](https://docs.expo.dev/versions/latest/sdk/fingerprint/)).
+3. Keep a single `react-native` version in the workspace. Duplicate React Native versions in one monorepo are not supported ([Expo: Monorepos](https://docs.expo.dev/guides/monorepos/)).
+
+EAS Build and Submit replace Railway for that app. CI `--affected` already includes `apps/*` and `packages/*`, so an Expo app is skipped when it did not change.
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the contribution workflow.

package/templates/turborepo/_gitignore

@@ -0,0 +1,53 @@
+node_modules
+.pnpm-store
+
+coverage
+playwright-report
+test-results
+*.tsbuildinfo
+
+.cache
+
+*.pem
+
+npm-debug.log*
+pnpm-debug.log*
+*.log
+
+**/.env*
+!.env.example
+
+.eslintcache
+
+.vscode/*
+!.vscode/settings.json
+!.vscode/extensions.json
+/.idea
+
+logs
+.temp
+.tmp
+
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+**/.DS_Store
+
+*.key
+*.p12
+*.pfx
+id_rsa*
+id_ed25519*
+
+/.claude/settings.local.json
+/.claude/worktrees/
+
+.next
+.turbo
+apps/backoffice/media
+/out
+next-env.d.ts

package/templates/turborepo/apps/app/.dependency-cruiser.json

@@ -0,0 +1,34 @@
+{
+  "extends": "dependency-cruiser/configs/recommended-strict",
+  "forbidden": [
+    {
+      "name": "no-orphans",
+      "to": {},
+      "from": {
+        "orphan": true,
+        "pathNot": [
+          "(^|/)tsconfig\\.json$",
+          "(^|/)eslint\\.config\\.ts$",
+          "(^|/)next\\.config\\.ts$",
+          "(^|/)postcss[.]config[.]mjs$",
+          "(^|/)vitest[.]config[.]ts$",
+          "(^|/)playwright[.]config[.]ts$",
+          "^test/.*[.]e2e[.]test[.]ts$",
+          "^app/.*(page|layout|template|loading|error|not-found|default|route)[.]tsx?$"
+        ]
+      }
+    }
+  ],
+  "options": {
+    "skipAnalysisNotInRules": true,
+    "tsPreCompilationDeps": true,
+    "enhancedResolveOptions": {
+      "conditionNames": ["import", "require", "node", "default", "types"],
+      "exportsFields": ["exports"]
+    },
+    "exclude": "(^|/)(?:\\.next|coverage|node_modules)/",
+    "tsConfig": {
+      "fileName": "tsconfig.json"
+    }
+  }
+}

package/templates/turborepo/apps/app/Dockerfile

@@ -0,0 +1,25 @@
+# Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+ENV NEXT_TELEMETRY_DISABLED=1
+WORKDIR /app
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY apps/app/package.json apps/app/package.json
+COPY apps/backoffice/package.json apps/backoffice/package.json
+RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN pnpm install --frozen-lockfile --ignore-scripts --filter ./apps/app...
+COPY apps/app/next.config.ts apps/app/postcss.config.mjs apps/app/tsconfig.json apps/app/
+COPY apps/app/app apps/app/app
+RUN pnpm --filter ./apps/app build
+
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
+WORKDIR /app
+# Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
+RUN apk upgrade --no-cache \
+  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+# Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/apps/app/public ./apps/app/public` when the app has a public/ folder.
+COPY --from=build --chown=node:node /app/apps/app/.next/standalone ./
+COPY --from=build --chown=node:node /app/apps/app/.next/static ./apps/app/.next/static
+USER 1000
+HEALTHCHECK --interval=30s --timeout=5s CMD ["node", "-e", "fetch('http://127.0.0.1:' + (process.env.PORT || 3000) + '/health').then(response => process.exit(response.ok ? 0 : 1), () => process.exit(1))"]
+CMD ["node", "apps/app/server.js"]

package/templates/turborepo/apps/app/app/globals.css

@@ -0,0 +1,26 @@
+@import "tailwindcss";
+
+:root {
+  --background: #ffffff;
+  --foreground: #171717;
+}
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --font-sans: var(--font-geist-sans);
+  --font-mono: var(--font-geist-mono);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --background: #0a0a0a;
+    --foreground: #ededed;
+  }
+}
+
+body {
+  background: var(--background);
+  color: var(--foreground);
+  font-family: var(--font-sans), sans-serif;
+}

package/templates/turborepo/apps/app/app/health/route.test.ts

@@ -0,0 +1,20 @@
+import {describe, expect, it, vi} from "vitest";
+
+import {GET} from "./route";
+
+vi.mock("next/server", () => ({
+  connection: vi.fn(async () => {}),
+}));
+
+describe("GET /health", () => {
+  it("reports ok without caching", async () => {
+    const response = await GET();
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("Cache-Control")).toBe("no-store");
+
+    await expect(response.json()).resolves.toEqual({
+      status: "ok",
+    });
+  });
+});

package/templates/turborepo/apps/app/app/health/route.ts

@@ -0,0 +1,23 @@
+import {connection} from "next/server";
+
+/**
+ * Report that the server is up, for platform health checks. Rendered per request and never cached, so a
+ * stopped server cannot pass from a cached response.
+ * @returns A JSON response with `status: "ok"`.
+ */
+async function get(): Promise<Response> {
+  await connection();
+
+  return Response.json(
+    {
+      status: "ok",
+    },
+    {
+      headers: {
+        "Cache-Control": "no-store",
+      },
+    },
+  );
+}
+
+export {get as GET};

package/templates/turborepo/apps/app/app/layout.tsx

@@ -0,0 +1,29 @@
+import {Geist, Geist_Mono} from "next/font/google";
+import type {Metadata} from "next";
+
+import "./globals.css";
+
+const geistSans = Geist({
+  variable: "--font-geist-sans",
+  subsets: ["latin"],
+});
+
+const geistMono = Geist_Mono({
+  variable: "--font-geist-mono",
+  subsets: ["latin"],
+});
+
+export const metadata: Metadata = {
+  title: "Next Friday Next.js template",
+  description: "Starter application for Next Friday Next.js projects.",
+};
+
+export default function RootLayout(props: LayoutProps<"/">) {
+  const {children} = props;
+
+  return (
+    <html className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`} lang="en">
+      <body className="flex min-h-full flex-col">{children}</body>
+    </html>
+  );
+}

package/templates/turborepo/apps/app/app/page.test.ts

@@ -0,0 +1,11 @@
+import {createElement} from "react";
+import {describe, expect, it} from "vitest";
+import {renderToStaticMarkup} from "react-dom/server";
+
+import Page from "./page";
+
+describe("Page", () => {
+  it("renders the template heading", () => {
+    expect(renderToStaticMarkup(createElement(Page))).toContain("Next Friday Next.js template");
+  });
+});

package/templates/turborepo/apps/app/app/page.tsx

@@ -0,0 +1,8 @@
+export default function Page() {
+  return (
+    <main className="flex flex-1 flex-col items-center justify-center gap-4 p-16 text-center">
+      <h1 className="text-3xl font-semibold tracking-tight">Next Friday Next.js template</h1>
+      <p className="text-lg text-zinc-600 dark:text-zinc-400">Edit app/page.tsx to get started.</p>
+    </main>
+  );
+}

package/templates/turborepo/apps/app/next.config.ts

@@ -0,0 +1,40 @@
+import {fileURLToPath} from "node:url";
+import path from "node:path";
+import type {NextConfig} from "next";
+
+const workspaceRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+const nextConfig: NextConfig = {
+  outputFileTracingRoot: workspaceRoot,
+  output: "standalone",
+  poweredByHeader: false,
+  cacheComponents: true,
+  partialPrefetching: true,
+  async headers() {
+    return [
+      {
+        source: "/:path*",
+        headers: [
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=63072000; includeSubDomains",
+          },
+          {
+            key: "X-Content-Type-Options",
+            value: "nosniff",
+          },
+          {
+            key: "X-Frame-Options",
+            value: "SAMEORIGIN",
+          },
+          {
+            key: "Referrer-Policy",
+            value: "strict-origin-when-cross-origin",
+          },
+        ],
+      },
+    ];
+  },
+};
+
+export default nextConfig;

package/templates/turborepo/apps/app/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@next-friday-template-turborepo/app",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Next Friday Next.js app.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "scripts": {
+    "build": "next build",
+    "depcruise": "depcruise --config .dependency-cruiser.json app test next.config.ts playwright.config.ts postcss.config.mjs vitest.config.ts",
+    "dev": "next dev --port 3000",
+    "start": "cp -R .next/static .next/standalone/apps/app/.next/ && (test ! -d public || cp -R public .next/standalone/apps/app/) && node .next/standalone/apps/app/server.js",
+    "test": "vitest run --passWithNoTests",
+    "test:changed": "if git rev-parse --quiet --verify origin/main > /dev/null && git diff --quiet \"$(git merge-base origin/main HEAD)\" -- pnpm-lock.yaml pnpm-workspace.yaml \"*package.json\" \"*tsconfig.json\" .husky; then vitest run --changed origin/main --passWithNoTests; else vitest run --passWithNoTests; fi",
+    "test:coverage": "vitest run --coverage --passWithNoTests",
+    "test:e2e": "playwright test",
+    "test:watch": "vitest",
+    "typecheck": "next typegen && tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "next": "16.4.3",
+    "react": "19.3.1",
+    "react-dom": "19.3.1"
+  },
+  "devDependencies": {
+    "@playwright/test": "1.64.1",
+    "@tailwindcss/postcss": "4.3.3",
+    "@types/node": "26.6.5",
+    "@types/react": "19.3.0",
+    "@types/react-dom": "19.3.0",
+    "@vitest/coverage-v8": "5.0.5",
+    "dependency-cruiser": "18.7.0",
+    "fast-check": "4.10.2",
+    "tailwindcss": "4.3.3",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5"
+  },
+  "engines": {
+    "node": ">=24.22.1 <25"
+  }
+}

package/templates/turborepo/apps/app/playwright.config.ts

@@ -0,0 +1,27 @@
+import {defineConfig, devices} from "@playwright/test";
+
+const isCi = Boolean(process.env.CI);
+
+export default defineConfig({
+  forbidOnly: isCi,
+  testDir: "test",
+  projects: [
+    {
+      name: "chromium",
+      use: devices["Desktop Chrome"],
+    },
+  ],
+  use: {
+    baseURL: "http://localhost:3000",
+    trace: "on-first-retry",
+  },
+  webServer: {
+    url: "http://localhost:3000",
+    command: isCi
+      ? "cp -R .next/static .next/standalone/apps/app/.next/ && (test ! -d public || cp -R public .next/standalone/apps/app/) && node .next/standalone/apps/app/server.js"
+      : "next dev --port 3000",
+    reuseExistingServer: !isCi,
+  },
+  reporter: isCi ? "github" : "list",
+  retries: isCi ? 2 : 0,
+});

package/templates/turborepo/apps/app/postcss.config.mjs

@@ -0,0 +1,7 @@
+const postcssConfig = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+
+export default postcssConfig;

package/templates/turborepo/apps/app/test/home.e2e.test.ts

@@ -0,0 +1,11 @@
+import {expect, test} from "@playwright/test";
+
+test("home page shows the template heading", async ({page}) => {
+  await page.goto("/");
+
+  await expect(
+    page.getByRole("heading", {
+      level: 1,
+    }),
+  ).toHaveText("Next Friday Next.js template");
+});

package/templates/turborepo/apps/app/tsconfig.json

@@ -0,0 +1,33 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "esModuleInterop": true,
+    "incremental": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": ["./*"]
+    },
+    "allowJs": true
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": ["node_modules", ".next"]
+}

package/templates/turborepo/apps/app/vitest.config.ts

@@ -0,0 +1,12 @@
+import {defineConfig} from "vitest/config";
+
+export default defineConfig({
+  test: {
+    coverage: {
+      reporter: ["text", "html", "cobertura"],
+      include: ["app/**/*.{ts,tsx}"],
+      exclude: ["app/**/*.test.{ts,tsx}", "app/**/layout.tsx"],
+    },
+    include: ["app/**/*.test.{ts,tsx}"],
+  },
+});

package/templates/turborepo/apps/backoffice/.dependency-cruiser.json

@@ -0,0 +1,34 @@
+{
+  "extends": "dependency-cruiser/configs/recommended-strict",
+  "forbidden": [
+    {
+      "name": "no-orphans",
+      "to": {},
+      "from": {
+        "orphan": true,
+        "pathNot": [
+          "(^|/)tsconfig\\.json$",
+          "(^|/)eslint\\.config\\.ts$",
+          "(^|/)next\\.config\\.ts$",
+          "(^|/)vitest[.]config[.]ts$",
+          "(^|/)playwright[.]config[.]ts$",
+          "^test/.*[.]e2e[.]test[.]ts$",
+          "^src/app/.*(page|layout|template|loading|error|not-found|default|route)[.]tsx?$",
+          "^src/payload-types[.]ts$"
+        ]
+      }
+    }
+  ],
+  "options": {
+    "skipAnalysisNotInRules": true,
+    "tsPreCompilationDeps": true,
+    "enhancedResolveOptions": {
+      "conditionNames": ["import", "require", "node", "default", "types"],
+      "exportsFields": ["exports"]
+    },
+    "exclude": "(^|/)(?:\\.next|coverage|node_modules)/|^src/app/[(]payload[)]/",
+    "tsConfig": {
+      "fileName": "tsconfig.json"
+    }
+  }
+}

package/templates/turborepo/apps/backoffice/Dockerfile

@@ -0,0 +1,28 @@
+# Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+ENV NEXT_TELEMETRY_DISABLED=1
+WORKDIR /app
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY apps/app/package.json apps/app/package.json
+COPY apps/backoffice/package.json apps/backoffice/package.json
+RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN pnpm install --frozen-lockfile --ignore-scripts --filter ./apps/backoffice...
+COPY apps/backoffice/next.config.ts apps/backoffice/tsconfig.json apps/backoffice/
+COPY apps/backoffice/src apps/backoffice/src
+# `next build` loads the Payload config, which requires these variables. The values are placeholders for the build only.
+# The platform sets the real ones at runtime, and the build never connects to the database.
+RUN PAYLOAD_SECRET=build-only DATABASE_URL=postgres://build-only@localhost/build-only APP_URL=http://localhost:3001 pnpm --filter ./apps/backoffice build
+
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
+WORKDIR /app
+# Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
+RUN apk upgrade --no-cache \
+  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-* \
+  && install -d -o node -g node apps/backoffice/media
+# Next.js writes .next/cache at runtime. Uploads go to the container filesystem, which is lost on redeploy; use a storage adapter or a mounted volume in production.
+COPY --from=build --chown=node:node /app/apps/backoffice/.next/standalone ./
+COPY --from=build --chown=node:node /app/apps/backoffice/.next/static ./apps/backoffice/.next/static
+USER 1000
+HEALTHCHECK --interval=30s --timeout=5s CMD ["node", "-e", "fetch('http://127.0.0.1:' + (process.env.PORT || 3000) + '/health').then(response => process.exit(response.ok ? 0 : 1), () => process.exit(1))"]
+CMD ["node", "apps/backoffice/server.js"]

package/templates/turborepo/apps/backoffice/next.config.ts

@@ -0,0 +1,48 @@
+import {fileURLToPath} from "node:url";
+import path from "node:path";
+import {withPayload} from "@payloadcms/next/withPayload";
+import type {NextConfig} from "next";
+
+const workspaceRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+const nextConfig: NextConfig = {
+  outputFileTracingRoot: workspaceRoot,
+  output: "standalone",
+  poweredByHeader: false,
+  images: {
+    localPatterns: [
+      {
+        pathname: "/api/media/file/**",
+      },
+    ],
+  },
+  async headers() {
+    return [
+      {
+        source: "/:path*",
+        headers: [
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=63072000; includeSubDomains",
+          },
+          {
+            key: "X-Content-Type-Options",
+            value: "nosniff",
+          },
+          {
+            key: "X-Frame-Options",
+            value: "SAMEORIGIN",
+          },
+          {
+            key: "Referrer-Policy",
+            value: "strict-origin-when-cross-origin",
+          },
+        ],
+      },
+    ];
+  },
+};
+
+export default withPayload(nextConfig, {
+  devBundleServerPackages: false,
+});