@smi-digital/create-smi-app 2.8.0 → 2.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.8.0",
+  "version": "2.9.1",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/integrations/strapi-astro/Dockerfile.backend.template

@@ -33,5 +33,15 @@ ENV PATH=/opt/node_modules/.bin:$PATH
 WORKDIR /opt/app
 COPY --from=builder /opt/app ./
 
+# Keep a pristine copy of the image's static public files (robots.txt, etc.).
+# public/ is a mounted volume at runtime, so the entrypoint reseeds from here.
+RUN cp -r /opt/app/public /opt/app/public-defaults
+
+# Entrypoint seeds static public files into the mounted volume on startup,
+# leaving uploaded media untouched. See docker-entrypoint.sh for why.
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
 EXPOSE 1337
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["npm", "run", "start"]

package/templates/integrations/strapi-astro/Dockerfile.frontend.ssr.template

@@ -12,6 +12,17 @@ WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
 COPY . .
+
+# PUBLIC_* are inlined into the CLIENT bundle at build time (they reach the
+# browser). The deploy passes these as --build-arg from project_domain/
+# backend_domain, so the image targets the right site/CMS per environment.
+ARG PUBLIC_SITE_URL=
+ARG PUBLIC_STRAPI_URL=
+ARG PUBLIC_GA_ID=
+ENV PUBLIC_SITE_URL=${PUBLIC_SITE_URL}
+ENV PUBLIC_STRAPI_URL=${PUBLIC_STRAPI_URL}
+ENV PUBLIC_GA_ID=${PUBLIC_GA_ID}
+
 RUN npm run build
 
 # Stage 2: Serve the SSR server bundle

package/templates/integrations/strapi-astro/docker-compose.yml.template

@@ -7,8 +7,11 @@ services:
     env_file:
       - ./backend.env
     volumes:
-      # Uploads stay on local disk for now; DB lives in Postgres (no sqlite volume).
-      - ./data/uploads:/opt/app/public/uploads
+      # Mount the whole public/ dir (not just public/uploads) so `strapi transfer`
+      # can move public/uploads during restore — a bind-mounted uploads SUBdir is a
+      # mount point and cannot be moved, which breaks transfers. DB lives in Postgres
+      # (no sqlite volume). The entrypoint reseeds static files (robots.txt) here.
+      - ./data/public:/opt/app/public
     networks:
       - agency_shared_network
     healthcheck:
@@ -18,19 +21,11 @@ services:
       timeout: 5s
       retries: 15
     labels:
-      - "traefik.enable=true"
-      # Route traffic from your backend domain to this container
-      - "traefik.http.routers.__APP_NAME__-strapi.rule=Host(`__BACKEND_DOMAIN__`)"
-      # Request an SSL certificate from the global Let's Encrypt resolver
-      - "traefik.http.routers.__APP_NAME__-strapi.tls.certresolver=letsencrypt"
-      # Tell Traefik which port to send traffic to inside the container
-      - "traefik.http.services.__APP_NAME__-strapi.loadbalancer.server.port=1337"
-      # Strapi requires larger body sizes for media uploads (25MB)
-      - "traefik.http.middlewares.__APP_NAME__-strapi-limit.buffering.maxRequestBodyBytes=25000000"
-      # Global middlewares (defined in webhosting-infra/traefik/dynamic) + the local
-      # body-size limit. rate-limit first so abusive traffic is dropped early; this
-      # matters most on the public Strapi admin/API.
-      - "traefik.http.routers.__APP_NAME__-strapi.middlewares=rate-limit@file,secure-headers@file,__APP_NAME__-strapi-limit"
+      # Strapi is no longer exposed to Traefik directly: the central
+      # __APP_NAME__-cache nginx now fronts BACKEND_DOMAIN and proxies here
+      # (caching /uploads). Keeping it internal means all backend traffic —
+      # admin, API and media — flows through the shared cache.
+      - "traefik.enable=false"
 
   __APP_NAME__-astro:
     container_name: __APP_NAME__-astro
@@ -57,15 +52,28 @@ services:
     container_name: __APP_NAME__-cache
     image: nginx:alpine
     restart: unless-stopped
+    environment:
+      # Injected into nginx-cache.conf via the nginx image's envsubst at start
+      # so this one proxy can server-name-route both public hosts. The filter
+      # restricts substitution to these vars, leaving nginx's own runtime
+      # $variables ($host, $upstream_cache_status, …) untouched.
+      PROJECT_DOMAIN: ${PROJECT_DOMAIN}
+      BACKEND_DOMAIN: ${BACKEND_DOMAIN}
+      NGINX_ENVSUBST_FILTER: "^(PROJECT_DOMAIN|BACKEND_DOMAIN)$$"
     volumes:
-      - ./frontend/nginx-cache.conf:/etc/nginx/conf.d/default.conf:ro
+      # Mounted as a template: the nginx entrypoint runs envsubst and writes the
+      # rendered config to conf.d/ before starting.
+      - ./frontend/nginx-cache.conf:/etc/nginx/templates/default.conf.template:ro
     networks:
       - agency_shared_network
     depends_on:
-      - __APP_NAME__-astro
+      __APP_NAME__-astro:
+        condition: service_healthy
+      __APP_NAME__-strapi:
+        condition: service_healthy
     healthcheck:
-      # Use 127.0.0.1 (not localhost): the read-only config mount blocks nginx's
-      # IPv6 listen, but busybox wget resolves localhost to ::1 first → refused.
+      # Use 127.0.0.1 (not localhost): busybox wget resolves localhost to ::1
+      # first, and the frontend block only listens on IPv4 → connection refused.
       test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/healthz"]
       interval: 5s
       timeout: 2s
@@ -75,13 +83,23 @@ services:
         order: start-first
     labels:
       - "traefik.enable=true"
-      # Listen on both www and non-www
-      - "traefik.http.routers.__APP_NAME__-astro.rule=Host(`__PROJECT_DOMAIN__`) || Host(`www.__PROJECT_DOMAIN__`)"
+      # Frontend host(s) → this cache (Astro SSR behind it). Listen on both
+      # www and non-www.
+      - "traefik.http.routers.__APP_NAME__-astro.rule=Host(`${PROJECT_DOMAIN}`) || Host(`www.${PROJECT_DOMAIN}`)"
       - "traefik.http.routers.__APP_NAME__-astro.tls.certresolver=letsencrypt"
       # Global middlewares (defined in webhosting-infra/traefik/dynamic)
       - "traefik.http.routers.__APP_NAME__-astro.middlewares=secure-headers@file,rate-limit@file"
-      # Route traffic to the Nginx Cache (Port 80) instead of Astro directly
-      - "traefik.http.services.__APP_NAME__-astro.loadbalancer.server.port=80"
+      - "traefik.http.routers.__APP_NAME__-astro.service=__APP_NAME__-cache"
+      # Backend host → this same cache (Strapi behind it; /uploads cached). The
+      # 25 MB upload body limit + rate-limit/secure-headers apply on this route.
+      - "traefik.http.routers.__APP_NAME__-strapi.rule=Host(`${BACKEND_DOMAIN}`)"
+      - "traefik.http.routers.__APP_NAME__-strapi.tls.certresolver=letsencrypt"
+      - "traefik.http.middlewares.__APP_NAME__-strapi-limit.buffering.maxRequestBodyBytes=25000000"
+      - "traefik.http.routers.__APP_NAME__-strapi.middlewares=rate-limit@file,secure-headers@file,__APP_NAME__-strapi-limit"
+      - "traefik.http.routers.__APP_NAME__-strapi.service=__APP_NAME__-cache"
+      # Both routers share this container's single service (Port 80), which
+      # proxies to Astro / Strapi by server_name.
+      - "traefik.http.services.__APP_NAME__-cache.loadbalancer.server.port=80"
 
 networks:
   agency_shared_network:

package/templates/integrations/strapi-astro/docker-entrypoint.sh.template

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+# The whole public/ directory is a mounted volume. We mount the parent (not just
+# public/uploads) so that `strapi transfer` can move public/uploads -> a backup
+# folder during restore: a bind-mounted uploads SUBdir is a mount point and the
+# kernel refuses to rename a mount point, which breaks transfers. With the parent
+# mounted, uploads is a normal subdir and behaves exactly like a non-Docker Strapi.
+#
+# Because the volume shadows the image's baked public/ (robots.txt, etc.), reseed
+# those static files on startup — but never touch uploaded media (public/uploads).
+mkdir -p /opt/app/public/uploads
+
+if [ -d /opt/app/public-defaults ]; then
+  for item in /opt/app/public-defaults/* /opt/app/public-defaults/.[!.]*; do
+    [ -e "$item" ] || continue
+    [ "$(basename "$item")" = "uploads" ] && continue
+    cp -rf "$item" /opt/app/public/
+  done
+fi
+
+exec "$@"

package/templates/integrations/strapi-astro/integration.config.json

@@ -57,6 +57,10 @@
       "template": "Dockerfile.backend.template",
       "target": "backend/Dockerfile"
     },
+    {
+      "template": "docker-entrypoint.sh.template",
+      "target": "backend/docker-entrypoint.sh"
+    },
     {
       "template": "Dockerfile.frontend.ssr.template",
       "target": "frontend/Dockerfile"

package/templates/integrations/strapi-astro/nginx-cache.conf.template

@@ -1,13 +1,39 @@
-proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=astro_cache:10m max_size=1g inactive=60m use_temp_path=off;
+# ─────────────────────────────────────────────────────────────────────────
+# Central reverse-proxy + cache for the whole project. ONE nginx fronts BOTH
+# public hosts and dispatches by server_name:
+#   • ${PROJECT_DOMAIN}  → Astro SSR   (stale-while-revalidate page cache)
+#   • ${BACKEND_DOMAIN}  → Strapi      (admin/API uncached; /uploads cached)
+#
+# Domains are injected at container start by the nginx image's envsubst
+# (it renders /etc/nginx/templates/*.template → /etc/nginx/conf.d/). The
+# compose service restricts substitution to PROJECT_DOMAIN/BACKEND_DOMAIN via
+# NGINX_ENVSUBST_FILTER, so nginx's own runtime variables ($host, $scheme,
+# $upstream_cache_status, …) are left untouched.
+# ─────────────────────────────────────────────────────────────────────────
 
-server {
-    listen 80;
+# Separate cache zones: short-lived SWR for SSR HTML, long-lived for media.
+proxy_cache_path /var/cache/nginx/astro  levels=1:2 keys_zone=astro_cache:10m  max_size=1g inactive=60m use_temp_path=off;
+proxy_cache_path /var/cache/nginx/strapi levels=1:2 keys_zone=strapi_cache:10m max_size=2g inactive=7d  use_temp_path=off;
 
-    # Gzip compression for faster transfers
-    gzip on;
-    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+# WebSocket upgrade support — `strapi transfer` and some admin features open a
+# WebSocket; without this the upgrade collapses to a plain 200 and the transfer
+# fails with "Unexpected server response 200".
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
 
-    # Liveness endpoint for the container healthcheck. Returns 200 from nginx
+gzip on;
+gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+# ── Frontend: Astro SSR ───────────────────────────────────────────────────
+# default_server so the container healthcheck (Host: 127.0.0.1) and any
+# unmatched host land here rather than on the Strapi block.
+server {
+    listen 80 default_server;
+    server_name ${PROJECT_DOMAIN} www.${PROJECT_DOMAIN};
+
+    # Liveness endpoint for the container healthcheck — answered by nginx
     # itself, so health reflects "the proxy is up" rather than the upstream
     # homepage's status code.
     location = /healthz {
@@ -18,21 +44,74 @@ server {
 
     location / {
         proxy_cache astro_cache;
-        
-        # Respect the Stale-While-Revalidate headers from Astro middleware
+
+        # Stale-While-Revalidate: serve fast, refresh in the background.
         proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
         proxy_cache_background_update on;
         proxy_cache_lock on;
 
-        # Proxy to the Astro SSR container (internal Docker DNS)
+        # Proxy to the Astro SSR container (internal Docker DNS).
         proxy_pass http://__APP_NAME__-astro:4321;
-        
+
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
 
-        # Add a header so we can verify if the cache is working
         add_header X-Cache-Status $upstream_cache_status;
     }
 }
+
+# ── Backend: Strapi ───────────────────────────────────────────────────────
+server {
+    listen 80;
+    server_name ${BACKEND_DOMAIN};
+
+    # Match the Traefik buffering limit so media uploads aren't capped at
+    # nginx's 1 MB default.
+    client_max_body_size 25m;
+
+    # Uploaded media: Strapi names files with a content hash, so they're
+    # effectively immutable — cache hard at the edge and in the browser, and
+    # serve stale while refreshing.
+    location /uploads/ {
+        proxy_cache strapi_cache;
+        proxy_cache_valid 200 30d;
+        proxy_cache_use_stale error timeout updating;
+        proxy_cache_background_update on;
+        proxy_cache_lock on;
+
+        # Media is static: ignore any cookie/cache headers Strapi attaches so
+        # the response is always cacheable, and never relay a Set-Cookie.
+        proxy_ignore_headers Set-Cookie Cache-Control Expires;
+        proxy_hide_header Set-Cookie;
+
+        proxy_pass http://__APP_NAME__-strapi:1337;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        add_header Cache-Control "public, max-age=2592000";
+        add_header X-Cache-Status $upstream_cache_status;
+    }
+
+    # Admin panel + content API: authenticated and live — never cache.
+    location / {
+        proxy_pass http://__APP_NAME__-strapi:1337;
+
+        # WebSocket upgrade (strapi transfer / admin). Long timeouts so a big
+        # data transfer isn't dropped mid-stream.
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}