create-nextblock 0.8.11 → 0.9.5

package/bin/create-nextblock.js

@@ -83,30 +83,46 @@ async function handleCommand(projectDirectory, options) {
   try {
     console.log(chalk.bold.cyan(`\n🧱 create-nextblock v${CLI_VERSION}\n`));
 
-    // Prerequisites gate (interactive only) — shown BEFORE we ask for a name, scaffold, or
-    // install, so anyone who isn't ready can cancel without creating anything.
+    // Pick the hosting profile up front (interactive only). Cloud = Vercel + Supabase Cloud;
+    // Docker = a fully local self-hosted sandbox that needs no cloud accounts.
+    let hostingMode = 'cloud';
     if (!yes) {
+      const modeChoice = await clack.select({
+        message: 'Select your target hosting environment profile:',
+        options: [
+          { value: 'cloud', label: 'Managed Cloud Mode (Vercel + Supabase Cloud)' },
+          {
+            value: 'docker',
+            label: 'Local Self-Hosted Docker Mode (One-Click Local Sandbox)',
+          },
+        ],
+        initialValue: 'cloud',
+      });
+      if (clack.isCancel(modeChoice)) {
+        handleWizardCancel('Setup cancelled.');
+      }
+      hostingMode = modeChoice;
+    }
+
+    // Cloud / local configuration moved to the browser First-Boot Setup Wizard (/setup), so the
+    // CLI no longer asks for Supabase / R2 / SMTP credentials here. Docker still preflights below.
+    if (!yes && hostingMode === 'docker') {
       clack.note(
         [
-          '1. A Supabase project   https://supabase.com/dashboard',
-          '   • Reference ID             — Project Settings > General > "Reference ID"',
-          '   • Connection string        — Connect (top bar) > Direct connection > URI',
-          '   • anon + service_role keys — Project Settings > API Keys',
-          '   • Personal Access Token    — Account > Access Tokens > Generate new token',
+          'Local Self-Hosted Docker Mode runs everything on your machine — no cloud accounts needed.',
           '',
-          '2. A Cloudflare R2 bucket   https://dash.cloudflare.com  > R2',
-          '   • Create a bucket, then enable its Public Development URL (Bucket > Settings > General)',
-          '   • Create an R2 API token (Object Read & Write); copy the Access Key ID + Secret (shown once)',
+          'Requirement:',
+          '  • Docker Desktop installed and running  (https://www.docker.com/products/docker-desktop)',
           '',
-          '3. SMTP credentials   SMTP2GO works very well: https://www.smtp2go.com',
-          '   • Required so Supabase can email the confirmation link your first admin needs to sign in',
+          'Optional (you can skip both at the prompts):',
+          '  • Cloudflare Turnstile keys (bot protection)',
+          '  • SMTP credentials (otherwise sign-ups auto-confirm with no email)',
         ].join('\n'),
-        'Before you continue, have all of the following ready',
+        'One-click local sandbox',
       );
 
       const ready = await clack.confirm({
-        message:
-          'Do you have your Supabase, Cloudflare R2, and SMTP details ready?',
+        message: 'Is Docker Desktop installed and running?',
         initialValue: true,
       });
       if (clack.isCancel(ready)) {
@@ -114,7 +130,7 @@ async function handleCommand(projectDirectory, options) {
       }
       if (!ready) {
         clack.note(
-          'No problem — nothing was created. Gather the items above, then run\n`npm create nextblock` again. Full guide: docs/05-DEVELOPER-GUIDE.md',
+          'No problem — nothing was created. Install & start Docker Desktop, then run\n`npm create nextblock` again.',
           'Come back when ready',
         );
         return;
@@ -214,26 +230,13 @@ async function handleCommand(projectDirectory, options) {
       console.log(chalk.yellow('Skipping dependency installation.'));
     }
 
-    // Run the setup wizard after dependencies are installed so package assets are available.
-    // When it runs, its own "next steps" outro (cd + npm run dev) is the final message, so we
-    // don't print a second closing block here — the whole flow completes in this one command.
-    if (!yes) {
-      await runSetupWizard(projectDir, projectName);
+    // Run the post-scaffold flow after dependencies are installed so package assets are available.
+    // Docker boots the local stack; everything else just materializes Supabase assets and points
+    // the user at the browser First-Boot Setup Wizard at /setup (no terminal credential prompts).
+    if (!yes && hostingMode === 'docker') {
+      await runDockerSetup(projectDir, projectName);
     } else {
-      // Non-interactive path: nothing was configured, so point the user at their env file.
-      console.log(
-        chalk.green(
-          `\nSuccess! Your NextBlock™ CMS project "${projectName}" is scaffolded.\n`,
-        ),
-      );
-      console.log(chalk.cyan('Next steps:'));
-      console.log(chalk.cyan(`  1. cd ${projectName}`));
-      console.log(
-        chalk.gray(
-          '  2. Add your Supabase / R2 / SMTP values to .env.local (template in .env.example)',
-        ),
-      );
-      console.log(chalk.cyan('  3. npm run dev'));
+      await runCloudScaffold(projectDir, projectName);
     }
   } catch (error) {
     console.error(
@@ -898,6 +901,65 @@ async function runSetupWizard(projectDir, projectName) {
   );
 }
 
+// Local Self-Hosted Docker Mode: materialize the supabase migrations out of the installed
+// @nextblock-cms/db package (the migration-runner container applies them on boot), then hand off
+// to the project's own zero-dependency Docker setup script (prompts + .env + `docker compose up`).
+async function runCloudScaffold(projectDir, projectName) {
+  const projectPath = resolve(projectDir);
+
+  // Materialize the Supabase assets (migrations + config) so `npm run db:migrate` works later,
+  // then hand off entirely to the browser First-Boot Setup Wizard for configuration. No
+  // credentials are collected in the terminal.
+  try {
+    await ensureSupabaseAssets(projectPath, { required: false });
+  } catch {
+    // Non-fatal: the wizard still works; db:migrate just needs these assets present.
+  }
+
+  console.log(
+    chalk.green(
+      `\nSuccess! Your NextBlock™ CMS project "${projectName}" is scaffolded.\n`,
+    ),
+  );
+  console.log(chalk.cyan('Next steps:'));
+  console.log(chalk.cyan(`  1. cd ${projectName}`));
+  console.log(chalk.cyan('  2. npm run dev'));
+  console.log(
+    `  3. Open ${chalk.cyan('/setup')} ${chalk.gray('in your browser (the URL npm run dev prints, e.g. http://localhost:3000/setup)')}`,
+  );
+  console.log(
+    chalk.gray('     Connect Supabase, configure storage / email, and create your administrator.'),
+  );
+  console.log('');
+  console.log(chalk.gray('  Self-hosted Docker instead?   npm run docker:setup'));
+  console.log(chalk.gray('  One-click cloud deploy:       see docs/12-VERCEL-DEPLOYMENT.md'));
+}
+
+async function runDockerSetup(projectDir, projectName) {
+  const projectPath = resolve(projectDir);
+  process.chdir(projectPath);
+
+  clack.intro('🐳 NextBlock™ CMS — Local Self-Hosted Docker setup');
+
+  await ensureSupabaseAssets(projectPath, { required: true });
+
+  const setupScript = resolve(projectPath, 'scripts', 'docker-setup.mjs');
+  if (!(await fs.pathExists(setupScript))) {
+    clack.note(
+      'scripts/docker-setup.mjs is missing from the template. Run `npm run sync:create-nextblock` and try again.',
+      'Docker setup unavailable',
+    );
+    return;
+  }
+
+  // The script drives docker compose interactively; inherit stdio so its prompts work.
+  await runCommand('node', ['scripts/docker-setup.mjs'], { cwd: projectPath });
+
+  clack.outro(
+    `🎉 Your NextBlock™ project ${projectName ? `"${projectName}" ` : ''}is running in Docker.\nApp: http://localhost:3000   (first sign-up becomes ADMIN)`,
+  );
+}
+
 async function configureHostedSupabaseAuth(
   projectDir,
   { projectId, siteUrl, accessToken, smtpValues },
@@ -1924,7 +1986,11 @@ function buildNextConfigContent(editorUtilNames) {
     '/**',
     " * @type {import('next').NextConfig}",
     ' **/',
+    // Self-hosted Docker builds emit a standalone server (`node server.js`); gated on
+    // DOCKER_BUILD so a normal `next build` / Vercel deploy is unaffected.
+    "const isDockerStandalone = process.env.DOCKER_BUILD === 'true';",
     'const nextConfig = {',
+    "  ...(isDockerStandalone ? { output: 'standalone' } : {}),",
     '  outputFileTracingRoot: path.join(__dirname),',
     '  env: {',
     '    NEXT_PUBLIC_SUPABASE_URL: process.env.NEXT_PUBLIC_SUPABASE_URL,',

package/docker-template/.dockerignore

@@ -0,0 +1,23 @@
+# Keep the build context lean; deps are reinstalled in the image and secrets stay out.
+node_modules
+.git
+.github
+.next
+out
+dist
+coverage
+tmp
+backup
+backups
+*.log
+npm-debug.log*
+
+# Secrets never enter the image (NEXT_PUBLIC_* arrive as build args).
+.env
+.env.*
+!.env.docker.example
+
+# Not needed inside the app image (mounted/used by other compose services instead).
+docker
+supabase/.branches
+supabase/.temp

package/docker-template/.env.docker.example

@@ -0,0 +1,56 @@
+# ──────────────────────────────────────────────────────────────────────────────
+# Reference for the Docker (self-hosted) .env that `npm run docker:setup` generates.
+# You normally do NOT edit this by hand — run `npm run docker:setup` and it writes a
+# `.env` with secure random secrets. This file documents every key the stack reads.
+# ──────────────────────────────────────────────────────────────────────────────
+
+# --- Auto-generated secrets (crypto-random) --------------------------------------------------
+POSTGRES_PASSWORD=replace-me-generated
+JWT_SECRET=replace-me-at-least-32-chars
+JWT_EXP=3600
+# anon + service_role keys are HS256 JWTs SIGNED with JWT_SECRET (generated for you):
+ANON_KEY=replace-me-anon-jwt
+SERVICE_ROLE_KEY=replace-me-service-role-jwt
+CRON_SECRET=replace-me-generated
+DRAFT_MODE_SECRET=replace-me-generated
+REVALIDATE_SECRET_TOKEN=replace-me-generated
+
+# --- Supabase wiring (internal container network vs browser) ---------------------------------
+NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
+NEXT_PUBLIC_SUPABASE_ANON_KEY=${ANON_KEY}
+SUPABASE_SERVICE_ROLE_KEY=${SERVICE_ROLE_KEY}
+API_EXTERNAL_URL=http://localhost:8000
+SITE_URL=http://localhost:3000
+POSTGRES_DB=postgres
+
+# --- App ------------------------------------------------------------------------------------
+NEXT_PUBLIC_URL=http://localhost:3000
+NEXT_PUBLIC_IS_SANDBOX=true
+CORTEX_AI_ENCRYPTION_KEY=
+
+# --- MinIO object storage (S3-compatible) ----------------------------------------------------
+MINIO_ROOT_USER=nextblock
+MINIO_ROOT_PASSWORD=replace-me-generated
+STORAGE_BUCKET=nextblock
+R2_ACCOUNT_ID=minio
+R2_REGION=us-east-1
+R2_S3_ENDPOINT=http://minio:9000
+# 127.0.0.1 (not localhost) so the browser never sends the app's localhost cookies to MinIO,
+# which would otherwise 400 (MetadataTooLarge) once the Supabase auth cookies grow.
+R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000
+R2_FORCE_PATH_STYLE=true
+NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/nextblock
+NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/nextblock
+
+# --- Cloudflare Turnstile (optional). Press Enter at setup to skip and use the dev sandbox. ---
+NEXT_PUBLIC_TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
+
+# --- SMTP (optional). Blank => GoTrue auto-confirms sign-ups (loopback mode). -----------------
+GOTRUE_MAILER_AUTOCONFIRM=true
+SMTP_HOST=
+SMTP_PORT=
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM_EMAIL=
+SMTP_FROM_NAME=

package/docker-template/Dockerfile

@@ -0,0 +1,85 @@
+# syntax=docker/dockerfile:1.7
+#
+# Production image for a standalone NextBlock CMS project (single Next.js app, not a monorepo).
+# Built with Next.js standalone output, gated on DOCKER_BUILD so a normal `npm run build` / a
+# Vercel deploy is unaffected. Driven by docker-compose.yml (`npm run docker:setup`).
+
+###############################################################################
+# Stage 1 — deps
+###############################################################################
+FROM node:22-alpine AS deps
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+COPY package.json ./
+RUN npm install --no-audit --no-fund
+
+###############################################################################
+# Stage 2 — builder (Next.js standalone output)
+###############################################################################
+FROM node:22-alpine AS builder
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+ENV NEXT_TELEMETRY_DISABLED=1 \
+    CI=true \
+    DOCKER_BUILD=true \
+    NODE_ENV=production
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+# NEXT_PUBLIC_* values are inlined into the browser bundle at build time. Server-only secrets are
+# NOT baked in — they arrive at runtime from docker-compose.yml.
+ARG NEXT_PUBLIC_SUPABASE_URL
+ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
+ARG NEXT_PUBLIC_URL
+ARG NEXT_PUBLIC_R2_PUBLIC_URL
+ARG NEXT_PUBLIC_R2_BASE_URL
+ARG NEXT_PUBLIC_TURNSTILE_SITE_KEY
+ARG NEXT_PUBLIC_IS_SANDBOX
+ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL \
+    NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY \
+    NEXT_PUBLIC_URL=$NEXT_PUBLIC_URL \
+    NEXT_PUBLIC_R2_PUBLIC_URL=$NEXT_PUBLIC_R2_PUBLIC_URL \
+    NEXT_PUBLIC_R2_BASE_URL=$NEXT_PUBLIC_R2_BASE_URL \
+    NEXT_PUBLIC_TURNSTILE_SITE_KEY=$NEXT_PUBLIC_TURNSTILE_SITE_KEY \
+    NEXT_PUBLIC_IS_SANDBOX=$NEXT_PUBLIC_IS_SANDBOX
+
+RUN npm run build
+
+###############################################################################
+# Stage 3 — runner (hardened, non-root)
+###############################################################################
+FROM node:22-alpine AS runner
+WORKDIR /app
+RUN apk add --no-cache libc6-compat socat \
+    && addgroup -g 1001 -S nodejs \
+    && adduser -u 1001 -S nextjs -G nodejs
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    HOSTNAME=0.0.0.0 \
+    # ipv4first so localhost resolves to the socat IPv4 listener; the larger header limit absorbs
+    # Supabase auth cookies (on localhost they aren't port-scoped, so they pile onto every request).
+    NODE_OPTIONS="--dns-result-order=ipv4first --max-http-header-size=65536"
+
+# A single-app project traces to its own root, so server.js sits at the top of .next/standalone.
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+# Loopback proxy: the browser-facing localhost URLs (Supabase :8000, MinIO :9000) are inlined into
+# the build, but server-side code + next/image run INSIDE this container. Forward those ports to the
+# compose services so SSR + image optimization work, and so the Supabase auth cookie key (derived
+# from the URL host) matches between browser and server. Override targets with LOOPBACK_PROXIES.
+RUN printf '%s\n' \
+  '#!/bin/sh' \
+  'set -e' \
+  ': "${LOOPBACK_PROXIES:=8000:kong:8000 9000:minio:9000}"' \
+  'for p in $LOOPBACK_PROXIES; do' \
+  '  socat "TCP4-LISTEN:${p%%:*},fork,reuseaddr,bind=127.0.0.1" "TCP:${p#*:}" 2>/dev/null &' \
+  'done' \
+  'exec node "$(cat .server-entry 2>/dev/null || echo server.js)"' \
+  > /app/docker-entrypoint.sh && chmod +x /app/docker-entrypoint.sh
+
+USER nextjs
+EXPOSE 3000
+ENTRYPOINT ["/app/docker-entrypoint.sh"]

package/docker-template/docker/db/init/99-jwt.sql

@@ -0,0 +1,6 @@
+-- Expose the JWT secret to Postgres as a database GUC, matching Supabase's setup. Runs once.
+\set jwt_secret `echo "$JWT_SECRET"`
+\set jwt_exp `echo "$JWT_EXP"`
+
+alter database postgres set "app.settings.jwt_secret" to :'jwt_secret';
+alter database postgres set "app.settings.jwt_exp" to :'jwt_exp';

package/docker-template/docker/db/init/99-roles.sql

@@ -0,0 +1,25 @@
+-- Self-hosted Supabase role passwords. The supabase/postgres image creates the platform roles;
+-- GoTrue logs in as supabase_auth_admin and PostgREST as authenticator. Give the roles that exist
+-- the generated POSTGRES_PASSWORD (the set varies by image tag, so each is guarded; the password
+-- is passed via a session GUC because psql variables aren't interpolated inside a dollar block).
+-- Runs once on first init.
+\set pgpass `echo "$POSTGRES_PASSWORD"`
+select set_config('nextblock.pgpass', :'pgpass', false);
+
+do $$
+declare
+  role_name text;
+begin
+  foreach role_name in array array[
+    'authenticator',
+    'pgbouncer',
+    'supabase_auth_admin',
+    'supabase_storage_admin',
+    'supabase_functions_admin',
+    'supabase_read_only_user'
+  ] loop
+    if exists (select 1 from pg_roles where rolname = role_name) then
+      execute format('alter role %I with password %L', role_name, current_setting('nextblock.pgpass'));
+    end if;
+  end loop;
+end $$;

package/docker-template/docker/kong/kong.yml

@@ -0,0 +1,112 @@
+# Kong declarative (DB-less) gateway config for the NextBlock self-hosted stack.
+#
+# $SUPABASE_ANON_KEY and $SUPABASE_SERVICE_KEY are substituted at container start by the kong
+# service entrypoint (docker-compose.yml) from the generated ANON_KEY / SERVICE_ROLE_KEY env.
+# Trimmed to just the Auth (GoTrue) and PostgREST routes the app uses.
+_format_version: '2.1'
+_transform: true
+
+consumers:
+  - username: anon
+    keyauth_credentials:
+      - key: $SUPABASE_ANON_KEY
+  - username: service_role
+    keyauth_credentials:
+      - key: $SUPABASE_SERVICE_KEY
+
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+services:
+  - name: auth-v1-open
+    url: http://auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  - name: auth-v1
+    url: http://auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: rest-v1
+    url: http://rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: graphql-v1
+    url: http://rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - 'Content-Profile: graphql_public'
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon

package/docker-template/docker/migrate/run-migrations.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Applies the NextBlock SQL migrations (mounted at /migrations) in chronological filename order,
+# once GoTrue has provisioned the auth schema (profiles etc. FK to auth.users). Idempotent: a
+# tracking table records applied versions so restarts never re-run a migration. Each file runs
+# in a single transaction (ON_ERROR_STOP).
+set -eu
+
+PGHOST="${POSTGRES_HOST:-db}"
+PGPORT="${POSTGRES_PORT:-5432}"
+PGUSER="postgres"
+PGDATABASE="${POSTGRES_DB:-postgres}"
+export PGPASSWORD="${POSTGRES_PASSWORD}"
+
+psql_cmd() {
+  psql -v ON_ERROR_STOP=1 -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" "$@"
+}
+
+echo "[migrate] waiting for Postgres at ${PGHOST}:${PGPORT}..."
+until psql_cmd -c 'select 1;' >/dev/null 2>&1; do
+  sleep 2
+done
+
+echo "[migrate] waiting for GoTrue to create auth.users..."
+until [ "$(psql_cmd -tAc "select to_regclass('auth.users') is not null;")" = "t" ]; do
+  sleep 2
+done
+
+psql_cmd -c "create table if not exists public._nextblock_docker_migrations (
+  version text primary key,
+  applied_at timestamptz not null default now()
+);"
+
+applied_any=0
+for file in $(ls /migrations/*.sql | sort); do
+  version="$(basename "$file" .sql)"
+  already="$(psql_cmd -tAc "select 1 from public._nextblock_docker_migrations where version = '${version}';")"
+  if [ "$already" = "1" ]; then
+    echo "[migrate] skip ${version} (already applied)"
+    continue
+  fi
+  echo "[migrate] applying ${version}"
+  psql_cmd --single-transaction -f "$file"
+  psql_cmd -c "insert into public._nextblock_docker_migrations (version) values ('${version}');"
+  applied_any=1
+done
+
+if [ "$applied_any" = "1" ]; then
+  echo "[migrate] migrations applied successfully."
+else
+  echo "[migrate] database already up to date."
+fi