create-nextblock 0.8.11 → 0.9.0

package/templates/nextblock-template/docker/kong/kong.yml

@@ -0,0 +1,112 @@
+# Kong declarative (DB-less) gateway config for the NextBlock self-hosted stack.
+#
+# $SUPABASE_ANON_KEY and $SUPABASE_SERVICE_KEY are substituted at container start by the kong
+# service entrypoint (docker-compose.yml) from the generated ANON_KEY / SERVICE_ROLE_KEY env.
+# Trimmed to just the Auth (GoTrue) and PostgREST routes the app uses.
+_format_version: '2.1'
+_transform: true
+
+consumers:
+  - username: anon
+    keyauth_credentials:
+      - key: $SUPABASE_ANON_KEY
+  - username: service_role
+    keyauth_credentials:
+      - key: $SUPABASE_SERVICE_KEY
+
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+services:
+  - name: auth-v1-open
+    url: http://auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  - name: auth-v1
+    url: http://auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: rest-v1
+    url: http://rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: graphql-v1
+    url: http://rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - 'Content-Profile: graphql_public'
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon

package/templates/nextblock-template/docker/migrate/run-migrations.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Applies the NextBlock SQL migrations (mounted at /migrations) in chronological filename order,
+# once GoTrue has provisioned the auth schema (profiles etc. FK to auth.users). Idempotent: a
+# tracking table records applied versions so restarts never re-run a migration. Each file runs
+# in a single transaction (ON_ERROR_STOP).
+set -eu
+
+PGHOST="${POSTGRES_HOST:-db}"
+PGPORT="${POSTGRES_PORT:-5432}"
+PGUSER="postgres"
+PGDATABASE="${POSTGRES_DB:-postgres}"
+export PGPASSWORD="${POSTGRES_PASSWORD}"
+
+psql_cmd() {
+  psql -v ON_ERROR_STOP=1 -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" "$@"
+}
+
+echo "[migrate] waiting for Postgres at ${PGHOST}:${PGPORT}..."
+until psql_cmd -c 'select 1;' >/dev/null 2>&1; do
+  sleep 2
+done
+
+echo "[migrate] waiting for GoTrue to create auth.users..."
+until [ "$(psql_cmd -tAc "select to_regclass('auth.users') is not null;")" = "t" ]; do
+  sleep 2
+done
+
+psql_cmd -c "create table if not exists public._nextblock_docker_migrations (
+  version text primary key,
+  applied_at timestamptz not null default now()
+);"
+
+applied_any=0
+for file in $(ls /migrations/*.sql | sort); do
+  version="$(basename "$file" .sql)"
+  already="$(psql_cmd -tAc "select 1 from public._nextblock_docker_migrations where version = '${version}';")"
+  if [ "$already" = "1" ]; then
+    echo "[migrate] skip ${version} (already applied)"
+    continue
+  fi
+  echo "[migrate] applying ${version}"
+  psql_cmd --single-transaction -f "$file"
+  psql_cmd -c "insert into public._nextblock_docker_migrations (version) values ('${version}');"
+  applied_any=1
+done
+
+if [ "$applied_any" = "1" ]; then
+  echo "[migrate] migrations applied successfully."
+else
+  echo "[migrate] database already up to date."
+fi

package/templates/nextblock-template/docker-compose.yml

@@ -0,0 +1,215 @@
+# Self-hosted NextBlock CMS stack for a standalone project. Generated/driven by
+# `npm run docker:setup`, which writes the .env this file reads. Mirrors the production Supabase
+# topology: Postgres + GoTrue + PostgREST behind a Kong gateway, plus MinIO for S3 media.
+name: nextblock
+
+services:
+  db:
+    image: ${SUPABASE_DB_IMAGE:-supabase/postgres:15.8.1.085}
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:-postgres}
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_EXP: ${JWT_EXP:-3600}
+    volumes:
+      - nextblock_db_store:/var/lib/postgresql/data
+      - ./docker/db/init/99-roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:ro
+      - ./docker/db/init/99-jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:ro
+    healthcheck:
+      test: ['CMD', 'pg_isready', '-U', 'postgres', '-h', 'localhost']
+      interval: 5s
+      timeout: 5s
+      retries: 12
+      # supabase/postgres runs a heavy first-init; give it time before counting health failures.
+      start_period: 60s
+    ports:
+      - '${POSTGRES_PORT_EXTERNAL:-54322}:5432'
+
+  auth:
+    image: ${SUPABASE_GOTRUE_IMAGE:-supabase/gotrue:v2.189.0}
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      GOTRUE_API_HOST: 0.0.0.0
+      GOTRUE_API_PORT: 9999
+      API_EXTERNAL_URL: ${API_EXTERNAL_URL:-http://localhost:8000}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}
+      GOTRUE_SITE_URL: ${SITE_URL:-http://localhost:3000}
+      GOTRUE_URI_ALLOW_LIST: '*'
+      GOTRUE_DISABLE_SIGNUP: 'false'
+      GOTRUE_JWT_ADMIN_ROLES: service_role
+      GOTRUE_JWT_AUD: authenticated
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      GOTRUE_JWT_EXP: ${JWT_EXP:-3600}
+      GOTRUE_JWT_SECRET: ${JWT_SECRET}
+      GOTRUE_JWT_ISSUER: ${API_EXTERNAL_URL:-http://localhost:8000}/auth/v1
+      GOTRUE_EXTERNAL_EMAIL_ENABLED: 'true'
+      GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-true}
+      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_FROM_EMAIL:-admin@example.com}
+      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
+      # Must be a valid integer even when SMTP is skipped (GoTrue parses it as int and crashes on
+      # ''). With no host + autoconfirm on, no mail is sent, so the value is otherwise inert.
+      GOTRUE_SMTP_PORT: ${SMTP_PORT:-2500}
+      GOTRUE_SMTP_USER: ${SMTP_USER:-}
+      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
+      GOTRUE_SMTP_SENDER_NAME: ${SMTP_FROM_NAME:-NextBlock}
+      GOTRUE_MAILER_URLPATHS_CONFIRMATION: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_RECOVERY: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_INVITE: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: /auth/v1/verify
+    healthcheck:
+      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:9999/health']
+      interval: 5s
+      timeout: 5s
+      retries: 15
+
+  rest:
+    image: ${SUPABASE_POSTGREST_IMAGE:-postgrest/postgrest:v12.2.12}
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}
+      PGRST_DB_SCHEMAS: public,graphql_public
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: ${JWT_SECRET}
+      PGRST_DB_USE_LEGACY_GUCS: 'false'
+      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
+      PGRST_APP_SETTINGS_JWT_EXP: ${JWT_EXP:-3600}
+      PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
+
+  kong:
+    image: ${SUPABASE_KONG_IMAGE:-kong:2.8.1}
+    restart: unless-stopped
+    depends_on:
+      auth:
+        condition: service_started
+      rest:
+        condition: service_started
+    environment:
+      KONG_DATABASE: 'off'
+      KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
+      KONG_DNS_ORDER: LAST,A,CNAME
+      KONG_PLUGINS: request-transformer,cors,key-auth,acl
+      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
+      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
+      SUPABASE_ANON_KEY: ${ANON_KEY}
+      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
+    volumes:
+      - ./docker/kong/kong.yml:/home/kong/temp.yml:ro
+    entrypoint: bash -c 'eval "echo \"$$(cat ~/temp.yml)\"" > ~/kong.yml && /docker-entrypoint.sh kong docker-start'
+    ports:
+      - '${KONG_HTTP_PORT:-8000}:8000'
+
+  minio:
+    image: ${MINIO_IMAGE:-minio/minio:latest}
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+    volumes:
+      - nextblock_media:/data
+    ports:
+      - '${MINIO_S3_PORT:-9000}:9000'
+      - '${MINIO_CONSOLE_PORT:-9001}:9001'
+
+  minio-init:
+    image: ${MINIO_MC_IMAGE:-minio/mc:latest}
+    restart: 'no'
+    depends_on:
+      minio:
+        condition: service_started
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+      STORAGE_BUCKET: ${STORAGE_BUCKET:-nextblock}
+    entrypoint: >
+      /bin/sh -c "
+      until mc alias set local http://minio:9000 $$MINIO_ROOT_USER $$MINIO_ROOT_PASSWORD; do echo 'waiting for minio...'; sleep 2; done &&
+      mc mb --ignore-existing local/$$STORAGE_BUCKET &&
+      mc anonymous set download local/$$STORAGE_BUCKET &&
+      echo 'minio bucket ready'
+      "
+
+  migrate:
+    image: ${MIGRATE_IMAGE:-postgres:15-alpine}
+    restart: 'no'
+    depends_on:
+      db:
+        condition: service_healthy
+      auth:
+        condition: service_healthy
+    environment:
+      POSTGRES_HOST: db
+      POSTGRES_PORT: 5432
+      POSTGRES_DB: ${POSTGRES_DB:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - ./supabase/migrations:/migrations:ro
+      - ./docker/migrate/run-migrations.sh:/run-migrations.sh:ro
+    entrypoint: ['sh', '/run-migrations.sh']
+
+  nextblock-cms:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-http://localhost:8000}
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
+        NEXT_PUBLIC_URL: ${NEXT_PUBLIC_URL:-http://localhost:3000}
+        NEXT_PUBLIC_R2_PUBLIC_URL: ${NEXT_PUBLIC_R2_PUBLIC_URL}
+        NEXT_PUBLIC_R2_BASE_URL: ${NEXT_PUBLIC_R2_BASE_URL}
+        NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY:-}
+        NEXT_PUBLIC_IS_SANDBOX: ${NEXT_PUBLIC_IS_SANDBOX:-true}
+    restart: unless-stopped
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      kong:
+        condition: service_started
+      minio-init:
+        condition: service_completed_successfully
+    environment:
+      NODE_ENV: production
+      PORT: 3000
+      HOSTNAME: 0.0.0.0
+      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-http://localhost:8000}
+      SUPABASE_INTERNAL_URL: ${SUPABASE_INTERNAL_URL:-http://kong:8000}
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
+      SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
+      NEXT_PUBLIC_URL: ${NEXT_PUBLIC_URL:-http://localhost:3000}
+      NEXT_PUBLIC_IS_SANDBOX: ${NEXT_PUBLIC_IS_SANDBOX:-true}
+      CRON_SECRET: ${CRON_SECRET}
+      DRAFT_MODE_SECRET: ${DRAFT_MODE_SECRET}
+      REVALIDATE_SECRET_TOKEN: ${REVALIDATE_SECRET_TOKEN}
+      CORTEX_AI_ENCRYPTION_KEY: ${CORTEX_AI_ENCRYPTION_KEY:-}
+      R2_ACCOUNT_ID: ${R2_ACCOUNT_ID:-minio}
+      R2_BUCKET_NAME: ${STORAGE_BUCKET:-nextblock}
+      R2_ACCESS_KEY_ID: ${MINIO_ROOT_USER}
+      R2_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
+      R2_REGION: ${R2_REGION:-us-east-1}
+      R2_S3_ENDPOINT: ${R2_S3_ENDPOINT:-http://minio:9000}
+      R2_S3_PUBLIC_ENDPOINT: ${R2_S3_PUBLIC_ENDPOINT:-http://localhost:9000}
+      R2_FORCE_PATH_STYLE: 'true'
+      NEXT_PUBLIC_R2_PUBLIC_URL: ${NEXT_PUBLIC_R2_PUBLIC_URL}
+      NEXT_PUBLIC_R2_BASE_URL: ${NEXT_PUBLIC_R2_BASE_URL}
+      SMTP_HOST: ${SMTP_HOST:-}
+      SMTP_PORT: ${SMTP_PORT:-}
+      SMTP_USER: ${SMTP_USER:-}
+      SMTP_PASS: ${SMTP_PASS:-}
+      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
+      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-}
+      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
+      NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY:-}
+    ports:
+      - '${APP_PORT:-3000}:3000'
+
+volumes:
+  nextblock_db_store:
+  nextblock_media:

package/templates/nextblock-template/lib/custom-block-r2-upload.test.ts

@@ -3,7 +3,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 vi.mock('server-only', () => ({}));
 
 const mocks = vi.hoisted(() => ({
-  getS3ClientMock: vi.fn(),
+  getS3PresignClientMock: vi.fn(),
   getSignedUrlMock: vi.fn(),
   getUserMock: vi.fn(),
   profileSingleMock: vi.fn(),
@@ -28,7 +28,7 @@ vi.mock('@nextblock-cms/db/server', () => ({
 }));
 
 vi.mock('@nextblock-cms/utils/server', () => ({
-  getS3Client: mocks.getS3ClientMock,
+  getS3PresignClient: mocks.getS3PresignClientMock,
 }));
 
 vi.mock('@aws-sdk/client-s3', () => ({
@@ -82,7 +82,7 @@ describe('custom block R2 presigned upload flow', () => {
     );
 
     expect(response.status).toBe(401);
-    expect(mocks.getS3ClientMock).not.toHaveBeenCalled();
+    expect(mocks.getS3PresignClientMock).not.toHaveBeenCalled();
   });
 
   it('rejects oversized files for authorized writers', async () => {
@@ -103,13 +103,13 @@ describe('custom block R2 presigned upload flow', () => {
 
     expect(response.status).toBe(400);
     expect(payload.error).toContain('10 MB');
-    expect(mocks.getS3ClientMock).not.toHaveBeenCalled();
+    expect(mocks.getS3PresignClientMock).not.toHaveBeenCalled();
   });
 
   it('returns a direct PUT upload space for authorized writers', async () => {
     mocks.getUserMock.mockResolvedValueOnce({ data: { user: { id: 'user-1' } }, error: null });
     mocks.profileSingleMock.mockResolvedValueOnce({ data: { role: 'ADMIN' }, error: null });
-    mocks.getS3ClientMock.mockResolvedValueOnce({ send: vi.fn() });
+    mocks.getS3PresignClientMock.mockResolvedValueOnce({ send: vi.fn() });
     mocks.getSignedUrlMock.mockResolvedValueOnce('https://r2.example.test/presigned-put');
 
     const response = await POST(

package/templates/nextblock-template/lib/custom-block-r2-upload.ts

@@ -2,7 +2,7 @@ import 'server-only';
 
 import { PutObjectCommand } from '@aws-sdk/client-s3';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
-import { getS3Client } from '@nextblock-cms/utils/server';
+import { getS3PresignClient } from '@nextblock-cms/utils/server';
 
 import { resolveMediaUrl } from './media/resolveMediaUrl';
 import {
@@ -35,7 +35,7 @@ export async function createR2PresignedUpload(
     throw new R2PresignedUploadError('File uploads are not configured on this server.', 500);
   }
 
-  const s3Client = await getS3Client();
+  const s3Client = await getS3PresignClient();
   if (!s3Client) {
     throw new R2PresignedUploadError('File uploads are not configured on this server.', 500);
   }

package/templates/nextblock-template/next.config.js

@@ -81,8 +81,17 @@ const securityHeaders = [
   },
 ];
 
+// Self-hosted Docker images build a standalone server (`node apps/nextblock/server.js`) instead
+// of `next start` + a full node_modules tree. Gated on DOCKER_BUILD so Vercel/cloud builds are
+// completely untouched. outputFileTracingRoot is pinned to the monorepo root so the standalone
+// output nests predictably under apps/nextblock (see the root Dockerfile runner stage).
+const isDockerStandalone = process.env.DOCKER_BUILD === 'true';
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  ...(isDockerStandalone
+    ? { output: 'standalone', outputFileTracingRoot: path.join(__dirname, '../../') }
+    : {}),
   experimental: {
     optimizePackageImports: ['@nextblock-cms/ui', '@nextblock-cms/utils'],
   },

package/templates/nextblock-template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/template",
-  "version": "0.8.11",
+  "version": "0.9.0",
   "private": true,
   "scripts": {
     "dev": "next dev",
@@ -8,7 +8,11 @@
     "start": "next start",
     "lint": "next lint",
     "deploy:supabase": "node tools/deploy-supabase.js",
-    "configure:supabase-auth": "node tools/configure-supabase-auth.js"
+    "configure:supabase-auth": "node tools/configure-supabase-auth.js",
+    "docker:setup": "node scripts/docker-setup.mjs",
+    "docker:up": "docker compose up -d --build",
+    "docker:down": "docker compose down",
+    "docker:logs": "docker compose logs -f nextblock-cms"
   },
   "dependencies": {
     "@ai-sdk/openai-compatible": "^2.0.42",