create-nextblock 0.12.9 → 0.12.12

package/docker-template/.dockerignore

@@ -1,23 +1,23 @@
-# Keep the build context lean; deps are reinstalled in the image and secrets stay out.
-node_modules
-.git
-.github
-.next
-out
-dist
-coverage
-tmp
-backup
-backups
-*.log
-npm-debug.log*
-
-# Secrets never enter the image (NEXT_PUBLIC_* arrive as build args).
-.env
-.env.*
-!.env.docker.example
-
-# Not needed inside the app image (mounted/used by other compose services instead).
-docker
-supabase/.branches
-supabase/.temp
+# Keep the build context lean; deps are reinstalled in the image and secrets stay out.
+node_modules
+.git
+.github
+.next
+out
+dist
+coverage
+tmp
+backup
+backups
+*.log
+npm-debug.log*
+
+# Secrets never enter the image (NEXT_PUBLIC_* arrive as build args).
+.env
+.env.*
+!.env.docker.example
+
+# Not needed inside the app image (mounted/used by other compose services instead).
+docker
+supabase/.branches
+supabase/.temp

package/docker-template/.env.docker.example

@@ -1,69 +1,69 @@
-# ──────────────────────────────────────────────────────────────────────────────
-# Reference for the Docker (self-hosted) .env that `npm run docker:setup` generates.
-# You normally do NOT edit this by hand — run `npm run docker:setup` and it writes a
-# `.env` with secure random secrets. This file documents every key the stack reads.
-# ──────────────────────────────────────────────────────────────────────────────
-
-# --- Auto-generated secrets (crypto-random) --------------------------------------------------
-POSTGRES_PASSWORD=replace-me-generated
-JWT_SECRET=replace-me-at-least-32-chars
-JWT_EXP=3600
-# anon + service_role keys are HS256 JWTs SIGNED with JWT_SECRET (generated for you):
-ANON_KEY=replace-me-anon-jwt
-SERVICE_ROLE_KEY=replace-me-service-role-jwt
-CRON_SECRET=replace-me-generated
-DRAFT_MODE_SECRET=replace-me-generated
-REVALIDATE_SECRET_TOKEN=replace-me-generated
-
-# --- Host port mappings ----------------------------------------------------------------------
-# The published host ports for each service. docker:setup auto-picks a FREE port when a default
-# is taken or reserved by the OS (common on Windows, e.g. Postgres 54322), then keeps the URLs
-# below and LOOPBACK_PROXIES in lockstep. Change a port here only if you also update its URL.
-APP_PORT=3000
-KONG_HTTP_PORT=8000
-MINIO_S3_PORT=9000
-MINIO_CONSOLE_PORT=9001
-POSTGRES_PORT_EXTERNAL=54322
-# In-container loopback (socat): maps the localhost:<port> server code derives from the public
-# URLs to the real service. Left-hand ports MUST match NEXT_PUBLIC_SUPABASE_URL / R2_S3_PUBLIC_ENDPOINT.
-LOOPBACK_PROXIES=8000:kong:8000 9000:minio:9000
-
-# --- Supabase wiring (internal container network vs browser) ---------------------------------
-NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
-NEXT_PUBLIC_SUPABASE_ANON_KEY=${ANON_KEY}
-SUPABASE_SERVICE_ROLE_KEY=${SERVICE_ROLE_KEY}
-API_EXTERNAL_URL=http://localhost:8000
-SITE_URL=http://localhost:3000
-POSTGRES_DB=postgres
-
-# --- App ------------------------------------------------------------------------------------
-NEXT_PUBLIC_URL=http://localhost:3000
-NEXT_PUBLIC_IS_SANDBOX=true
-CORTEX_AI_ENCRYPTION_KEY=
-
-# --- MinIO object storage (S3-compatible) ----------------------------------------------------
-MINIO_ROOT_USER=nextblock
-MINIO_ROOT_PASSWORD=replace-me-generated
-STORAGE_BUCKET=nextblock
-R2_ACCOUNT_ID=minio
-R2_REGION=us-east-1
-R2_S3_ENDPOINT=http://minio:9000
-# 127.0.0.1 (not localhost) so the browser never sends the app's localhost cookies to MinIO,
-# which would otherwise 400 (MetadataTooLarge) once the Supabase auth cookies grow.
-R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000
-R2_FORCE_PATH_STYLE=true
-NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/nextblock
-NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/nextblock
-
-# --- Cloudflare Turnstile (optional). Press Enter at setup to skip and use the dev sandbox. ---
-NEXT_PUBLIC_TURNSTILE_SITE_KEY=
-TURNSTILE_SECRET_KEY=
-
-# --- SMTP (optional). Blank => GoTrue auto-confirms sign-ups (loopback mode). -----------------
-GOTRUE_MAILER_AUTOCONFIRM=true
-SMTP_HOST=
-SMTP_PORT=
-SMTP_USER=
-SMTP_PASS=
-SMTP_FROM_EMAIL=
-SMTP_FROM_NAME=
+# ──────────────────────────────────────────────────────────────────────────────
+# Reference for the Docker (self-hosted) .env that `npm run docker:setup` generates.
+# You normally do NOT edit this by hand — run `npm run docker:setup` and it writes a
+# `.env` with secure random secrets. This file documents every key the stack reads.
+# ──────────────────────────────────────────────────────────────────────────────
+
+# --- Auto-generated secrets (crypto-random) --------------------------------------------------
+POSTGRES_PASSWORD=replace-me-generated
+JWT_SECRET=replace-me-at-least-32-chars
+JWT_EXP=3600
+# anon + service_role keys are HS256 JWTs SIGNED with JWT_SECRET (generated for you):
+ANON_KEY=replace-me-anon-jwt
+SERVICE_ROLE_KEY=replace-me-service-role-jwt
+CRON_SECRET=replace-me-generated
+DRAFT_MODE_SECRET=replace-me-generated
+REVALIDATE_SECRET_TOKEN=replace-me-generated
+
+# --- Host port mappings ----------------------------------------------------------------------
+# The published host ports for each service. docker:setup auto-picks a FREE port when a default
+# is taken or reserved by the OS (common on Windows, e.g. Postgres 54322), then keeps the URLs
+# below and LOOPBACK_PROXIES in lockstep. Change a port here only if you also update its URL.
+APP_PORT=3000
+KONG_HTTP_PORT=8000
+MINIO_S3_PORT=9000
+MINIO_CONSOLE_PORT=9001
+POSTGRES_PORT_EXTERNAL=54322
+# In-container loopback (socat): maps the localhost:<port> server code derives from the public
+# URLs to the real service. Left-hand ports MUST match NEXT_PUBLIC_SUPABASE_URL / R2_S3_PUBLIC_ENDPOINT.
+LOOPBACK_PROXIES=8000:kong:8000 9000:minio:9000
+
+# --- Supabase wiring (internal container network vs browser) ---------------------------------
+NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
+NEXT_PUBLIC_SUPABASE_ANON_KEY=${ANON_KEY}
+SUPABASE_SERVICE_ROLE_KEY=${SERVICE_ROLE_KEY}
+API_EXTERNAL_URL=http://localhost:8000
+SITE_URL=http://localhost:3000
+POSTGRES_DB=postgres
+
+# --- App ------------------------------------------------------------------------------------
+NEXT_PUBLIC_URL=http://localhost:3000
+NEXT_PUBLIC_IS_SANDBOX=true
+CORTEX_AI_ENCRYPTION_KEY=
+
+# --- MinIO object storage (S3-compatible) ----------------------------------------------------
+MINIO_ROOT_USER=nextblock
+MINIO_ROOT_PASSWORD=replace-me-generated
+STORAGE_BUCKET=nextblock
+R2_ACCOUNT_ID=minio
+R2_REGION=us-east-1
+R2_S3_ENDPOINT=http://minio:9000
+# 127.0.0.1 (not localhost) so the browser never sends the app's localhost cookies to MinIO,
+# which would otherwise 400 (MetadataTooLarge) once the Supabase auth cookies grow.
+R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000
+R2_FORCE_PATH_STYLE=true
+NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/nextblock
+NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/nextblock
+
+# --- Cloudflare Turnstile (optional). Press Enter at setup to skip and use the dev sandbox. ---
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
+
+# --- SMTP (optional). Blank => GoTrue auto-confirms sign-ups (loopback mode). -----------------
+GOTRUE_MAILER_AUTOCONFIRM=true
+SMTP_HOST=
+SMTP_PORT=
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM_EMAIL=
+SMTP_FROM_NAME=

package/docker-template/docker/db/init/99-jwt.sql

@@ -1,6 +1,6 @@
--- Expose the JWT secret to Postgres as a database GUC, matching Supabase's setup. Runs once.
-\set jwt_secret `echo "$JWT_SECRET"`
-\set jwt_exp `echo "$JWT_EXP"`
-
-alter database postgres set "app.settings.jwt_secret" to :'jwt_secret';
-alter database postgres set "app.settings.jwt_exp" to :'jwt_exp';
+-- Expose the JWT secret to Postgres as a database GUC, matching Supabase's setup. Runs once.
+\set jwt_secret `echo "$JWT_SECRET"`
+\set jwt_exp `echo "$JWT_EXP"`
+
+alter database postgres set "app.settings.jwt_secret" to :'jwt_secret';
+alter database postgres set "app.settings.jwt_exp" to :'jwt_exp';

package/docker-template/docker/db/init/99-roles.sql

@@ -1,25 +1,25 @@
--- Self-hosted Supabase role passwords. The supabase/postgres image creates the platform roles;
--- GoTrue logs in as supabase_auth_admin and PostgREST as authenticator. Give the roles that exist
--- the generated POSTGRES_PASSWORD (the set varies by image tag, so each is guarded; the password
--- is passed via a session GUC because psql variables aren't interpolated inside a dollar block).
--- Runs once on first init.
-\set pgpass `echo "$POSTGRES_PASSWORD"`
-select set_config('nextblock.pgpass', :'pgpass', false);
-
-do $$
-declare
-  role_name text;
-begin
-  foreach role_name in array array[
-    'authenticator',
-    'pgbouncer',
-    'supabase_auth_admin',
-    'supabase_storage_admin',
-    'supabase_functions_admin',
-    'supabase_read_only_user'
-  ] loop
-    if exists (select 1 from pg_roles where rolname = role_name) then
-      execute format('alter role %I with password %L', role_name, current_setting('nextblock.pgpass'));
-    end if;
-  end loop;
-end $$;
+-- Self-hosted Supabase role passwords. The supabase/postgres image creates the platform roles;
+-- GoTrue logs in as supabase_auth_admin and PostgREST as authenticator. Give the roles that exist
+-- the generated POSTGRES_PASSWORD (the set varies by image tag, so each is guarded; the password
+-- is passed via a session GUC because psql variables aren't interpolated inside a dollar block).
+-- Runs once on first init.
+\set pgpass `echo "$POSTGRES_PASSWORD"`
+select set_config('nextblock.pgpass', :'pgpass', false);
+
+do $$
+declare
+  role_name text;
+begin
+  foreach role_name in array array[
+    'authenticator',
+    'pgbouncer',
+    'supabase_auth_admin',
+    'supabase_storage_admin',
+    'supabase_functions_admin',
+    'supabase_read_only_user'
+  ] loop
+    if exists (select 1 from pg_roles where rolname = role_name) then
+      execute format('alter role %I with password %L', role_name, current_setting('nextblock.pgpass'));
+    end if;
+  end loop;
+end $$;

package/docker-template/docker/kong/kong.yml

@@ -1,112 +1,112 @@
-# Kong declarative (DB-less) gateway config for the NextBlock self-hosted stack.
-#
-# $SUPABASE_ANON_KEY and $SUPABASE_SERVICE_KEY are substituted at container start by the kong
-# service entrypoint (docker-compose.yml) from the generated ANON_KEY / SERVICE_ROLE_KEY env.
-# Trimmed to just the Auth (GoTrue) and PostgREST routes the app uses.
-_format_version: '2.1'
-_transform: true
-
-consumers:
-  - username: anon
-    keyauth_credentials:
-      - key: $SUPABASE_ANON_KEY
-  - username: service_role
-    keyauth_credentials:
-      - key: $SUPABASE_SERVICE_KEY
-
-acls:
-  - consumer: anon
-    group: anon
-  - consumer: service_role
-    group: admin
-
-services:
-  - name: auth-v1-open
-    url: http://auth:9999/verify
-    routes:
-      - name: auth-v1-open
-        strip_path: true
-        paths:
-          - /auth/v1/verify
-    plugins:
-      - name: cors
-  - name: auth-v1-open-callback
-    url: http://auth:9999/callback
-    routes:
-      - name: auth-v1-open-callback
-        strip_path: true
-        paths:
-          - /auth/v1/callback
-    plugins:
-      - name: cors
-  - name: auth-v1-open-authorize
-    url: http://auth:9999/authorize
-    routes:
-      - name: auth-v1-open-authorize
-        strip_path: true
-        paths:
-          - /auth/v1/authorize
-    plugins:
-      - name: cors
-
-  - name: auth-v1
-    url: http://auth:9999/
-    routes:
-      - name: auth-v1-all
-        strip_path: true
-        paths:
-          - /auth/v1/
-    plugins:
-      - name: cors
-      - name: key-auth
-        config:
-          hide_credentials: false
-      - name: acl
-        config:
-          hide_groups_header: true
-          allow:
-            - admin
-            - anon
-
-  - name: rest-v1
-    url: http://rest:3000/
-    routes:
-      - name: rest-v1-all
-        strip_path: true
-        paths:
-          - /rest/v1/
-    plugins:
-      - name: cors
-      - name: key-auth
-        config:
-          hide_credentials: true
-      - name: acl
-        config:
-          hide_groups_header: true
-          allow:
-            - admin
-            - anon
-
-  - name: graphql-v1
-    url: http://rest:3000/rpc/graphql
-    routes:
-      - name: graphql-v1-all
-        strip_path: true
-        paths:
-          - /graphql/v1
-    plugins:
-      - name: cors
-      - name: key-auth
-        config:
-          hide_credentials: false
-      - name: request-transformer
-        config:
-          add:
-            headers:
-              - 'Content-Profile: graphql_public'
-      - name: acl
-        config:
-          hide_groups_header: true
-          allow:
-            - admin
-            - anon
+# Kong declarative (DB-less) gateway config for the NextBlock self-hosted stack.
+#
+# $SUPABASE_ANON_KEY and $SUPABASE_SERVICE_KEY are substituted at container start by the kong
+# service entrypoint (docker-compose.yml) from the generated ANON_KEY / SERVICE_ROLE_KEY env.
+# Trimmed to just the Auth (GoTrue) and PostgREST routes the app uses.
+_format_version: '2.1'
+_transform: true
+
+consumers:
+  - username: anon
+    keyauth_credentials:
+      - key: $SUPABASE_ANON_KEY
+  - username: service_role
+    keyauth_credentials:
+      - key: $SUPABASE_SERVICE_KEY
+
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+services:
+  - name: auth-v1-open
+    url: http://auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  - name: auth-v1
+    url: http://auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: rest-v1
+    url: http://rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: graphql-v1
+    url: http://rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - 'Content-Profile: graphql_public'
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon