create-nextblock 0.8.11 → 0.9.0

package/bin/create-nextblock.js

@@ -83,9 +83,30 @@ async function handleCommand(projectDirectory, options) {
   try {
     console.log(chalk.bold.cyan(`\n🧱 create-nextblock v${CLI_VERSION}\n`));
 
+    // Pick the hosting profile up front (interactive only). Cloud = Vercel + Supabase Cloud;
+    // Docker = a fully local self-hosted sandbox that needs no cloud accounts.
+    let hostingMode = 'cloud';
+    if (!yes) {
+      const modeChoice = await clack.select({
+        message: 'Select your target hosting environment profile:',
+        options: [
+          { value: 'cloud', label: 'Managed Cloud Mode (Vercel + Supabase Cloud)' },
+          {
+            value: 'docker',
+            label: 'Local Self-Hosted Docker Mode (One-Click Local Sandbox)',
+          },
+        ],
+        initialValue: 'cloud',
+      });
+      if (clack.isCancel(modeChoice)) {
+        handleWizardCancel('Setup cancelled.');
+      }
+      hostingMode = modeChoice;
+    }
+
     // Prerequisites gate (interactive only) — shown BEFORE we ask for a name, scaffold, or
     // install, so anyone who isn't ready can cancel without creating anything.
-    if (!yes) {
+    if (!yes && hostingMode === 'cloud') {
       clack.note(
         [
           '1. A Supabase project   https://supabase.com/dashboard',
@@ -119,6 +140,35 @@ async function handleCommand(projectDirectory, options) {
         );
         return;
       }
+    } else if (!yes && hostingMode === 'docker') {
+      clack.note(
+        [
+          'Local Self-Hosted Docker Mode runs everything on your machine — no cloud accounts needed.',
+          '',
+          'Requirement:',
+          '  • Docker Desktop installed and running  (https://www.docker.com/products/docker-desktop)',
+          '',
+          'Optional (you can skip both at the prompts):',
+          '  • Cloudflare Turnstile keys (bot protection)',
+          '  • SMTP credentials (otherwise sign-ups auto-confirm with no email)',
+        ].join('\n'),
+        'One-click local sandbox',
+      );
+
+      const ready = await clack.confirm({
+        message: 'Is Docker Desktop installed and running?',
+        initialValue: true,
+      });
+      if (clack.isCancel(ready)) {
+        handleWizardCancel('Setup cancelled.');
+      }
+      if (!ready) {
+        clack.note(
+          'No problem — nothing was created. Install & start Docker Desktop, then run\n`npm create nextblock` again.',
+          'Come back when ready',
+        );
+        return;
+      }
     }
 
     let projectName = projectDirectory;
@@ -214,11 +264,15 @@ async function handleCommand(projectDirectory, options) {
       console.log(chalk.yellow('Skipping dependency installation.'));
     }
 
-    // Run the setup wizard after dependencies are installed so package assets are available.
-    // When it runs, its own "next steps" outro (cd + npm run dev) is the final message, so we
-    // don't print a second closing block here — the whole flow completes in this one command.
+    // Run the setup flow after dependencies are installed so package assets are available.
+    // When it runs, its own "next steps" outro is the final message, so we don't print a second
+    // closing block here — the whole flow completes in this one command.
     if (!yes) {
-      await runSetupWizard(projectDir, projectName);
+      if (hostingMode === 'docker') {
+        await runDockerSetup(projectDir, projectName);
+      } else {
+        await runSetupWizard(projectDir, projectName);
+      }
     } else {
       // Non-interactive path: nothing was configured, so point the user at their env file.
       console.log(
@@ -898,6 +952,34 @@ async function runSetupWizard(projectDir, projectName) {
   );
 }
 
+// Local Self-Hosted Docker Mode: materialize the supabase migrations out of the installed
+// @nextblock-cms/db package (the migration-runner container applies them on boot), then hand off
+// to the project's own zero-dependency Docker setup script (prompts + .env + `docker compose up`).
+async function runDockerSetup(projectDir, projectName) {
+  const projectPath = resolve(projectDir);
+  process.chdir(projectPath);
+
+  clack.intro('🐳 NextBlock™ CMS — Local Self-Hosted Docker setup');
+
+  await ensureSupabaseAssets(projectPath, { required: true });
+
+  const setupScript = resolve(projectPath, 'scripts', 'docker-setup.mjs');
+  if (!(await fs.pathExists(setupScript))) {
+    clack.note(
+      'scripts/docker-setup.mjs is missing from the template. Run `npm run sync:create-nextblock` and try again.',
+      'Docker setup unavailable',
+    );
+    return;
+  }
+
+  // The script drives docker compose interactively; inherit stdio so its prompts work.
+  await runCommand('node', ['scripts/docker-setup.mjs'], { cwd: projectPath });
+
+  clack.outro(
+    `🎉 Your NextBlock™ project ${projectName ? `"${projectName}" ` : ''}is running in Docker.\nApp: http://localhost:3000   (first sign-up becomes ADMIN)`,
+  );
+}
+
 async function configureHostedSupabaseAuth(
   projectDir,
   { projectId, siteUrl, accessToken, smtpValues },
@@ -1924,7 +2006,11 @@ function buildNextConfigContent(editorUtilNames) {
     '/**',
     " * @type {import('next').NextConfig}",
     ' **/',
+    // Self-hosted Docker builds emit a standalone server (`node server.js`); gated on
+    // DOCKER_BUILD so a normal `next build` / Vercel deploy is unaffected.
+    "const isDockerStandalone = process.env.DOCKER_BUILD === 'true';",
     'const nextConfig = {',
+    "  ...(isDockerStandalone ? { output: 'standalone' } : {}),",
     '  outputFileTracingRoot: path.join(__dirname),',
     '  env: {',
     '    NEXT_PUBLIC_SUPABASE_URL: process.env.NEXT_PUBLIC_SUPABASE_URL,',

package/docker-template/.dockerignore

@@ -0,0 +1,23 @@
+# Keep the build context lean; deps are reinstalled in the image and secrets stay out.
+node_modules
+.git
+.github
+.next
+out
+dist
+coverage
+tmp
+backup
+backups
+*.log
+npm-debug.log*
+
+# Secrets never enter the image (NEXT_PUBLIC_* arrive as build args).
+.env
+.env.*
+!.env.docker.example
+
+# Not needed inside the app image (mounted/used by other compose services instead).
+docker
+supabase/.branches
+supabase/.temp

package/docker-template/.env.docker.example

@@ -0,0 +1,55 @@
+# ──────────────────────────────────────────────────────────────────────────────
+# Reference for the Docker (self-hosted) .env that `npm run docker:setup` generates.
+# You normally do NOT edit this by hand — run `npm run docker:setup` and it writes a
+# `.env` with secure random secrets. This file documents every key the stack reads.
+# ──────────────────────────────────────────────────────────────────────────────
+
+# --- Auto-generated secrets (crypto-random) --------------------------------------------------
+POSTGRES_PASSWORD=replace-me-generated
+JWT_SECRET=replace-me-at-least-32-chars
+JWT_EXP=3600
+# anon + service_role keys are HS256 JWTs SIGNED with JWT_SECRET (generated for you):
+ANON_KEY=replace-me-anon-jwt
+SERVICE_ROLE_KEY=replace-me-service-role-jwt
+CRON_SECRET=replace-me-generated
+DRAFT_MODE_SECRET=replace-me-generated
+REVALIDATE_SECRET_TOKEN=replace-me-generated
+
+# --- Supabase wiring (internal container network vs browser) ---------------------------------
+NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
+SUPABASE_INTERNAL_URL=http://kong:8000
+NEXT_PUBLIC_SUPABASE_ANON_KEY=${ANON_KEY}
+SUPABASE_SERVICE_ROLE_KEY=${SERVICE_ROLE_KEY}
+API_EXTERNAL_URL=http://localhost:8000
+SITE_URL=http://localhost:3000
+POSTGRES_DB=postgres
+
+# --- App ------------------------------------------------------------------------------------
+NEXT_PUBLIC_URL=http://localhost:3000
+NEXT_PUBLIC_IS_SANDBOX=true
+CORTEX_AI_ENCRYPTION_KEY=
+
+# --- MinIO object storage (S3-compatible) ----------------------------------------------------
+MINIO_ROOT_USER=nextblock
+MINIO_ROOT_PASSWORD=replace-me-generated
+STORAGE_BUCKET=nextblock
+R2_ACCOUNT_ID=minio
+R2_REGION=us-east-1
+R2_S3_ENDPOINT=http://minio:9000
+R2_S3_PUBLIC_ENDPOINT=http://localhost:9000
+R2_FORCE_PATH_STYLE=true
+NEXT_PUBLIC_R2_BASE_URL=http://localhost:9000/nextblock
+NEXT_PUBLIC_R2_PUBLIC_URL=http://localhost:9000/nextblock
+
+# --- Cloudflare Turnstile (optional). Press Enter at setup to skip and use the dev sandbox. ---
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
+
+# --- SMTP (optional). Blank => GoTrue auto-confirms sign-ups (loopback mode). -----------------
+GOTRUE_MAILER_AUTOCONFIRM=true
+SMTP_HOST=
+SMTP_PORT=
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM_EMAIL=
+SMTP_FROM_NAME=

package/docker-template/Dockerfile

@@ -0,0 +1,68 @@
+# syntax=docker/dockerfile:1.7
+#
+# Production image for a standalone NextBlock CMS project (single Next.js app, not a monorepo).
+# Built with Next.js standalone output, gated on DOCKER_BUILD so a normal `npm run build` / a
+# Vercel deploy is unaffected. Driven by docker-compose.yml (`npm run docker:setup`).
+
+###############################################################################
+# Stage 1 — deps
+###############################################################################
+FROM node:22-alpine AS deps
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+COPY package.json ./
+RUN npm install --no-audit --no-fund
+
+###############################################################################
+# Stage 2 — builder (Next.js standalone output)
+###############################################################################
+FROM node:22-alpine AS builder
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+ENV NEXT_TELEMETRY_DISABLED=1 \
+    CI=true \
+    DOCKER_BUILD=true \
+    NODE_ENV=production
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+# NEXT_PUBLIC_* values are inlined into the browser bundle at build time. Server-only secrets are
+# NOT baked in — they arrive at runtime from docker-compose.yml.
+ARG NEXT_PUBLIC_SUPABASE_URL
+ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
+ARG NEXT_PUBLIC_URL
+ARG NEXT_PUBLIC_R2_PUBLIC_URL
+ARG NEXT_PUBLIC_R2_BASE_URL
+ARG NEXT_PUBLIC_TURNSTILE_SITE_KEY
+ARG NEXT_PUBLIC_IS_SANDBOX
+ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL \
+    NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY \
+    NEXT_PUBLIC_URL=$NEXT_PUBLIC_URL \
+    NEXT_PUBLIC_R2_PUBLIC_URL=$NEXT_PUBLIC_R2_PUBLIC_URL \
+    NEXT_PUBLIC_R2_BASE_URL=$NEXT_PUBLIC_R2_BASE_URL \
+    NEXT_PUBLIC_TURNSTILE_SITE_KEY=$NEXT_PUBLIC_TURNSTILE_SITE_KEY \
+    NEXT_PUBLIC_IS_SANDBOX=$NEXT_PUBLIC_IS_SANDBOX
+
+RUN npm run build
+
+###############################################################################
+# Stage 3 — runner (hardened, non-root)
+###############################################################################
+FROM node:22-alpine AS runner
+WORKDIR /app
+RUN apk add --no-cache libc6-compat \
+    && addgroup -g 1001 -S nodejs \
+    && adduser -u 1001 -S nextjs -G nodejs
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    HOSTNAME=0.0.0.0
+
+# A single-app project traces to its own root, so server.js sits at the top of .next/standalone.
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+USER nextjs
+EXPOSE 3000
+CMD ["node", "server.js"]

package/docker-template/docker/db/init/99-jwt.sql

@@ -0,0 +1,6 @@
+-- Expose the JWT secret to Postgres as a database GUC, matching Supabase's setup. Runs once.
+\set jwt_secret `echo "$JWT_SECRET"`
+\set jwt_exp `echo "$JWT_EXP"`
+
+alter database postgres set "app.settings.jwt_secret" to :'jwt_secret';
+alter database postgres set "app.settings.jwt_exp" to :'jwt_exp';

package/docker-template/docker/db/init/99-roles.sql

@@ -0,0 +1,25 @@
+-- Self-hosted Supabase role passwords. The supabase/postgres image creates the platform roles;
+-- GoTrue logs in as supabase_auth_admin and PostgREST as authenticator. Give the roles that exist
+-- the generated POSTGRES_PASSWORD (the set varies by image tag, so each is guarded; the password
+-- is passed via a session GUC because psql variables aren't interpolated inside a dollar block).
+-- Runs once on first init.
+\set pgpass `echo "$POSTGRES_PASSWORD"`
+select set_config('nextblock.pgpass', :'pgpass', false);
+
+do $$
+declare
+  role_name text;
+begin
+  foreach role_name in array array[
+    'authenticator',
+    'pgbouncer',
+    'supabase_auth_admin',
+    'supabase_storage_admin',
+    'supabase_functions_admin',
+    'supabase_read_only_user'
+  ] loop
+    if exists (select 1 from pg_roles where rolname = role_name) then
+      execute format('alter role %I with password %L', role_name, current_setting('nextblock.pgpass'));
+    end if;
+  end loop;
+end $$;

package/docker-template/docker/kong/kong.yml

@@ -0,0 +1,112 @@
+# Kong declarative (DB-less) gateway config for the NextBlock self-hosted stack.
+#
+# $SUPABASE_ANON_KEY and $SUPABASE_SERVICE_KEY are substituted at container start by the kong
+# service entrypoint (docker-compose.yml) from the generated ANON_KEY / SERVICE_ROLE_KEY env.
+# Trimmed to just the Auth (GoTrue) and PostgREST routes the app uses.
+_format_version: '2.1'
+_transform: true
+
+consumers:
+  - username: anon
+    keyauth_credentials:
+      - key: $SUPABASE_ANON_KEY
+  - username: service_role
+    keyauth_credentials:
+      - key: $SUPABASE_SERVICE_KEY
+
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+services:
+  - name: auth-v1-open
+    url: http://auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  - name: auth-v1
+    url: http://auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: rest-v1
+    url: http://rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: graphql-v1
+    url: http://rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - 'Content-Profile: graphql_public'
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon

package/docker-template/docker/migrate/run-migrations.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Applies the NextBlock SQL migrations (mounted at /migrations) in chronological filename order,
+# once GoTrue has provisioned the auth schema (profiles etc. FK to auth.users). Idempotent: a
+# tracking table records applied versions so restarts never re-run a migration. Each file runs
+# in a single transaction (ON_ERROR_STOP).
+set -eu
+
+PGHOST="${POSTGRES_HOST:-db}"
+PGPORT="${POSTGRES_PORT:-5432}"
+PGUSER="postgres"
+PGDATABASE="${POSTGRES_DB:-postgres}"
+export PGPASSWORD="${POSTGRES_PASSWORD}"
+
+psql_cmd() {
+  psql -v ON_ERROR_STOP=1 -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" "$@"
+}
+
+echo "[migrate] waiting for Postgres at ${PGHOST}:${PGPORT}..."
+until psql_cmd -c 'select 1;' >/dev/null 2>&1; do
+  sleep 2
+done
+
+echo "[migrate] waiting for GoTrue to create auth.users..."
+until [ "$(psql_cmd -tAc "select to_regclass('auth.users') is not null;")" = "t" ]; do
+  sleep 2
+done
+
+psql_cmd -c "create table if not exists public._nextblock_docker_migrations (
+  version text primary key,
+  applied_at timestamptz not null default now()
+);"
+
+applied_any=0
+for file in $(ls /migrations/*.sql | sort); do
+  version="$(basename "$file" .sql)"
+  already="$(psql_cmd -tAc "select 1 from public._nextblock_docker_migrations where version = '${version}';")"
+  if [ "$already" = "1" ]; then
+    echo "[migrate] skip ${version} (already applied)"
+    continue
+  fi
+  echo "[migrate] applying ${version}"
+  psql_cmd --single-transaction -f "$file"
+  psql_cmd -c "insert into public._nextblock_docker_migrations (version) values ('${version}');"
+  applied_any=1
+done
+
+if [ "$applied_any" = "1" ]; then
+  echo "[migrate] migrations applied successfully."
+else
+  echo "[migrate] database already up to date."
+fi