create-nextblock 0.8.11 → 0.9.5

package/docker-template/docker-compose.yml

@@ -0,0 +1,219 @@
+# Self-hosted NextBlock CMS stack for a standalone project. Generated/driven by
+# `npm run docker:setup`, which writes the .env this file reads. Mirrors the production Supabase
+# topology: Postgres + GoTrue + PostgREST behind a Kong gateway, plus MinIO for S3 media.
+name: nextblock
+
+services:
+  db:
+    image: ${SUPABASE_DB_IMAGE:-supabase/postgres:15.8.1.085}
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:-postgres}
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_EXP: ${JWT_EXP:-3600}
+    volumes:
+      - nextblock_db_store:/var/lib/postgresql/data
+      - ./docker/db/init/99-roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:ro
+      - ./docker/db/init/99-jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:ro
+    healthcheck:
+      test: ['CMD', 'pg_isready', '-U', 'postgres', '-h', 'localhost']
+      interval: 5s
+      timeout: 5s
+      retries: 12
+      # supabase/postgres runs a heavy first-init; give it time before counting health failures.
+      start_period: 60s
+    ports:
+      - '${POSTGRES_PORT_EXTERNAL:-54322}:5432'
+
+  auth:
+    image: ${SUPABASE_GOTRUE_IMAGE:-supabase/gotrue:v2.189.0}
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      GOTRUE_API_HOST: 0.0.0.0
+      GOTRUE_API_PORT: 9999
+      API_EXTERNAL_URL: ${API_EXTERNAL_URL:-http://localhost:8000}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}
+      GOTRUE_SITE_URL: ${SITE_URL:-http://localhost:3000}
+      GOTRUE_URI_ALLOW_LIST: '*'
+      GOTRUE_DISABLE_SIGNUP: 'false'
+      GOTRUE_JWT_ADMIN_ROLES: service_role
+      GOTRUE_JWT_AUD: authenticated
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      GOTRUE_JWT_EXP: ${JWT_EXP:-3600}
+      GOTRUE_JWT_SECRET: ${JWT_SECRET}
+      GOTRUE_JWT_ISSUER: ${API_EXTERNAL_URL:-http://localhost:8000}/auth/v1
+      GOTRUE_EXTERNAL_EMAIL_ENABLED: 'true'
+      GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-true}
+      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_FROM_EMAIL:-admin@example.com}
+      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
+      # Must be a valid integer even when SMTP is skipped (GoTrue parses it as int and crashes on
+      # ''). With no host + autoconfirm on, no mail is sent, so the value is otherwise inert.
+      GOTRUE_SMTP_PORT: ${SMTP_PORT:-2500}
+      GOTRUE_SMTP_USER: ${SMTP_USER:-}
+      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
+      GOTRUE_SMTP_SENDER_NAME: ${SMTP_FROM_NAME:-NextBlock}
+      GOTRUE_MAILER_URLPATHS_CONFIRMATION: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_RECOVERY: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_INVITE: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: /auth/v1/verify
+    healthcheck:
+      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:9999/health']
+      interval: 5s
+      timeout: 5s
+      retries: 15
+
+  rest:
+    image: ${SUPABASE_POSTGREST_IMAGE:-postgrest/postgrest:v12.2.12}
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}
+      PGRST_DB_SCHEMAS: public,graphql_public
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: ${JWT_SECRET}
+      PGRST_DB_USE_LEGACY_GUCS: 'false'
+      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
+      PGRST_APP_SETTINGS_JWT_EXP: ${JWT_EXP:-3600}
+      PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
+
+  kong:
+    image: ${SUPABASE_KONG_IMAGE:-kong:2.8.1}
+    restart: unless-stopped
+    depends_on:
+      auth:
+        condition: service_started
+      rest:
+        condition: service_started
+    environment:
+      KONG_DATABASE: 'off'
+      KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
+      KONG_DNS_ORDER: LAST,A,CNAME
+      KONG_PLUGINS: request-transformer,cors,key-auth,acl
+      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
+      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
+      # localhost cookies aren't port-scoped, so the app's Supabase auth cookies are also sent to
+      # Kong on every supabase-js request — give nginx room so they don't 431.
+      KONG_NGINX_HTTP_LARGE_CLIENT_HEADER_BUFFERS: 8 32k
+      SUPABASE_ANON_KEY: ${ANON_KEY}
+      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
+    volumes:
+      - ./docker/kong/kong.yml:/home/kong/temp.yml:ro
+    entrypoint: bash -c 'eval "echo \"$$(cat ~/temp.yml)\"" > ~/kong.yml && /docker-entrypoint.sh kong docker-start'
+    ports:
+      - '${KONG_HTTP_PORT:-8000}:8000'
+
+  minio:
+    image: ${MINIO_IMAGE:-minio/minio:latest}
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+    volumes:
+      - nextblock_media:/data
+    ports:
+      - '${MINIO_S3_PORT:-9000}:9000'
+      - '${MINIO_CONSOLE_PORT:-9001}:9001'
+
+  minio-init:
+    image: ${MINIO_MC_IMAGE:-minio/mc:latest}
+    restart: 'no'
+    depends_on:
+      minio:
+        condition: service_started
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+      STORAGE_BUCKET: ${STORAGE_BUCKET:-nextblock}
+    entrypoint: >
+      /bin/sh -c "
+      until mc alias set local http://minio:9000 $$MINIO_ROOT_USER $$MINIO_ROOT_PASSWORD; do echo 'waiting for minio...'; sleep 2; done &&
+      mc mb --ignore-existing local/$$STORAGE_BUCKET &&
+      mc anonymous set download local/$$STORAGE_BUCKET &&
+      echo 'minio bucket ready'
+      "
+
+  migrate:
+    image: ${MIGRATE_IMAGE:-postgres:15-alpine}
+    restart: 'no'
+    depends_on:
+      db:
+        condition: service_healthy
+      auth:
+        condition: service_healthy
+    environment:
+      POSTGRES_HOST: db
+      POSTGRES_PORT: 5432
+      POSTGRES_DB: ${POSTGRES_DB:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - ./supabase/migrations:/migrations:ro
+      - ./docker/migrate/run-migrations.sh:/run-migrations.sh:ro
+    entrypoint: ['sh', '/run-migrations.sh']
+
+  nextblock-cms:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-http://localhost:8000}
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
+        NEXT_PUBLIC_URL: ${NEXT_PUBLIC_URL:-http://localhost:3000}
+        NEXT_PUBLIC_R2_PUBLIC_URL: ${NEXT_PUBLIC_R2_PUBLIC_URL}
+        NEXT_PUBLIC_R2_BASE_URL: ${NEXT_PUBLIC_R2_BASE_URL}
+        NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY:-}
+        NEXT_PUBLIC_IS_SANDBOX: ${NEXT_PUBLIC_IS_SANDBOX:-true}
+    restart: unless-stopped
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      kong:
+        condition: service_started
+      minio-init:
+        condition: service_completed_successfully
+    environment:
+      NODE_ENV: production
+      PORT: 3000
+      HOSTNAME: 0.0.0.0
+      # Browser AND server both use localhost:8000; the in-container loopback proxy (see Dockerfile)
+      # forwards it to Kong, keeping the host-derived Supabase auth cookie key consistent for SSR.
+      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-http://localhost:8000}
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
+      SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
+      NEXT_PUBLIC_URL: ${NEXT_PUBLIC_URL:-http://localhost:3000}
+      NEXT_PUBLIC_IS_SANDBOX: ${NEXT_PUBLIC_IS_SANDBOX:-true}
+      CRON_SECRET: ${CRON_SECRET}
+      DRAFT_MODE_SECRET: ${DRAFT_MODE_SECRET}
+      REVALIDATE_SECRET_TOKEN: ${REVALIDATE_SECRET_TOKEN}
+      CORTEX_AI_ENCRYPTION_KEY: ${CORTEX_AI_ENCRYPTION_KEY:-}
+      R2_ACCOUNT_ID: ${R2_ACCOUNT_ID:-minio}
+      R2_BUCKET_NAME: ${STORAGE_BUCKET:-nextblock}
+      R2_ACCESS_KEY_ID: ${MINIO_ROOT_USER}
+      R2_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
+      R2_REGION: ${R2_REGION:-us-east-1}
+      R2_S3_ENDPOINT: ${R2_S3_ENDPOINT:-http://minio:9000}
+      R2_S3_PUBLIC_ENDPOINT: ${R2_S3_PUBLIC_ENDPOINT:-http://localhost:9000}
+      R2_FORCE_PATH_STYLE: 'true'
+      NEXT_PUBLIC_R2_PUBLIC_URL: ${NEXT_PUBLIC_R2_PUBLIC_URL}
+      NEXT_PUBLIC_R2_BASE_URL: ${NEXT_PUBLIC_R2_BASE_URL}
+      SMTP_HOST: ${SMTP_HOST:-}
+      SMTP_PORT: ${SMTP_PORT:-}
+      SMTP_USER: ${SMTP_USER:-}
+      SMTP_PASS: ${SMTP_PASS:-}
+      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
+      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-}
+      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
+      NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY:-}
+    ports:
+      - '${APP_PORT:-3000}:3000'
+
+volumes:
+  nextblock_db_store:
+  nextblock_media:

package/docker-template/scripts/docker-setup.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+// Zero-dependency Docker setup for a standalone NextBlock project. Runs via `npm run docker:setup`
+// (and is invoked automatically when you pick Docker mode in `npm create nextblock`). Uses only
+// Node built-ins so it works before any host `npm install`.
+//
+// Self-hosted Supabase (GoTrue + PostgREST) validates REAL HS256 JWTs, so we generate a JWT
+// secret and derive properly-signed anon/service_role keys from it — a random string is not a
+// usable key. Then it writes .env and boots the stack via docker compose.
+
+import { randomBytes, createHmac } from 'node:crypto';
+import { readFile, writeFile, access } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn, spawnSync } from 'node:child_process';
+import { createInterface } from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PROJECT_ROOT = resolve(__dirname, '..');
+const ENV_PATH = resolve(PROJECT_ROOT, '.env');
+
+const TURNSTILE_TEST_SITE_KEY = '1x00000000000000000000AA';
+const TURNSTILE_TEST_SECRET_KEY = '1x0000000000000000000000000000000AA';
+
+const generateSecret = () => randomBytes(32).toString('hex');
+const base64url = (value) =>
+  Buffer.from(value).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+
+function signJwtHS256(payload, secret) {
+  const header = base64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const body = base64url(JSON.stringify(payload));
+  const data = `${header}.${body}`;
+  return `${data}.${base64url(createHmac('sha256', secret).update(data).digest())}`;
+}
+
+function generateSupabaseKeys() {
+  const jwtSecret = generateSecret();
+  const iat = Math.floor(Date.now() / 1000);
+  const exp = iat + 60 * 60 * 24 * 365 * 10;
+  return {
+    jwtSecret,
+    anonKey: signJwtHS256({ role: 'anon', iss: 'supabase', iat, exp }, jwtSecret),
+    serviceRoleKey: signJwtHS256({ role: 'service_role', iss: 'supabase', iat, exp }, jwtSecret),
+  };
+}
+
+function readEnvValue(content, key) {
+  for (const line of content.split(/\r?\n/)) {
+    if (line.startsWith(`${key}=`)) {
+      return line.slice(key.length + 1).trim().replace(/^"(.*)"$/, '$1');
+    }
+  }
+  return '';
+}
+
+function upsertEnv(content, replacements) {
+  const applied = new Set();
+  const lines = content.split(/\r?\n/).map((line) => {
+    for (const [key, value] of Object.entries(replacements)) {
+      if (line.startsWith(`${key}=`)) {
+        applied.add(key);
+        return value;
+      }
+    }
+    return line;
+  });
+  for (const [key, value] of Object.entries(replacements)) {
+    if (!applied.has(key)) lines.push(value);
+  }
+  return lines.join('\n');
+}
+
+const pathExists = async (p) => {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const commandWorks = (cmd, args) => spawnSync(cmd, args, { stdio: 'ignore' }).status === 0;
+
+function detectCompose() {
+  if (commandWorks('docker', ['compose', 'version'])) return { cmd: 'docker', args: ['compose'] };
+  if (commandWorks('docker-compose', ['version'])) return { cmd: 'docker-compose', args: [] };
+  return null;
+}
+
+const run = (cmd, args, opts = {}) =>
+  new Promise((res, rej) => {
+    const child = spawn(cmd, args, {
+      stdio: 'inherit',
+      shell: process.platform === 'win32',
+      ...opts,
+    });
+    child.on('error', rej);
+    child.on('close', (code) => (code === 0 ? res() : rej(new Error(`${cmd} exited with ${code}`))));
+  });
+
+async function main() {
+  console.log('🐳 NextBlock — Local Self-Hosted Docker Setup\n');
+
+  if (!commandWorks('docker', ['info'])) {
+    console.error('✗ Docker is not installed or not running. Start Docker Desktop, then re-run `npm run docker:setup`.');
+    process.exit(1);
+  }
+  const compose = detectCompose();
+  if (!compose) {
+    console.error('✗ Docker Compose not found. Update Docker Desktop or install the Compose plugin.');
+    process.exit(1);
+  }
+
+  const rl = createInterface({ input, output });
+  const ask = async (q, def = '') => (await rl.question(q)).trim() || def;
+
+  console.log('Optional integrations (press Enter to skip):');
+  let turnstileSiteKey = await ask('  Cloudflare Turnstile Site Key (Enter = sandbox test keys): ');
+  let turnstileSecretKey = '';
+  if (turnstileSiteKey) {
+    turnstileSecretKey = await ask('  Cloudflare Turnstile Secret Key: ');
+  } else {
+    turnstileSiteKey = TURNSTILE_TEST_SITE_KEY;
+    turnstileSecretKey = TURNSTILE_TEST_SECRET_KEY;
+    console.log('  → Using Cloudflare Turnstile test keys (always pass).');
+  }
+
+  const smtp = { host: await ask('  SMTP Host (Enter = no email, auto-confirm sign-ups): '), port: '', user: '', pass: '', fromEmail: '', fromName: '' };
+  let mailerAutoconfirm = 'true';
+  if (smtp.host) {
+    smtp.port = await ask('  SMTP Port (465 = SSL, 587 = STARTTLS): ', '587');
+    smtp.user = await ask('  SMTP User: ');
+    smtp.pass = await ask('  SMTP Password: ');
+    smtp.fromEmail = await ask('  From Email: ');
+    smtp.fromName = await ask('  From Name: ', 'NextBlock');
+    mailerAutoconfirm = 'false';
+  } else {
+    console.log('  → No SMTP: new accounts auto-confirm so your first admin can sign in immediately.');
+  }
+  rl.close();
+
+  let existing = '';
+  if (await pathExists(ENV_PATH)) {
+    existing = await readFile(ENV_PATH, 'utf8');
+    console.log('\n✓ Found existing .env — reusing previously generated secrets where present.');
+  }
+  const reuse = (key, gen) => readEnvValue(existing, key) || gen();
+
+  const postgresPassword = reuse('POSTGRES_PASSWORD', generateSecret);
+  let jwtSecret = readEnvValue(existing, 'JWT_SECRET');
+  let anonKey = readEnvValue(existing, 'ANON_KEY');
+  let serviceRoleKey = readEnvValue(existing, 'SERVICE_ROLE_KEY');
+  if (!jwtSecret || !anonKey || !serviceRoleKey) {
+    ({ jwtSecret, anonKey, serviceRoleKey } = generateSupabaseKeys());
+  }
+  const cronSecret = reuse('CRON_SECRET', generateSecret);
+  const draftSecret = reuse('DRAFT_MODE_SECRET', generateSecret);
+  const revalidateSecret = reuse('REVALIDATE_SECRET_TOKEN', generateSecret);
+  const minioUser = readEnvValue(existing, 'MINIO_ROOT_USER') || 'nextblock';
+  const minioPassword = reuse('MINIO_ROOT_PASSWORD', generateSecret);
+  const bucket = readEnvValue(existing, 'STORAGE_BUCKET') || 'nextblock';
+
+  const replacements = {
+    POSTGRES_PASSWORD: `POSTGRES_PASSWORD=${postgresPassword}`,
+    POSTGRES_DB: 'POSTGRES_DB=postgres',
+    JWT_SECRET: `JWT_SECRET=${jwtSecret}`,
+    JWT_EXP: 'JWT_EXP=3600',
+    ANON_KEY: `ANON_KEY=${anonKey}`,
+    SERVICE_ROLE_KEY: `SERVICE_ROLE_KEY=${serviceRoleKey}`,
+    NEXT_PUBLIC_SUPABASE_URL: 'NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000',
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: `NEXT_PUBLIC_SUPABASE_ANON_KEY=${anonKey}`,
+    SUPABASE_SERVICE_ROLE_KEY: `SUPABASE_SERVICE_ROLE_KEY=${serviceRoleKey}`,
+    API_EXTERNAL_URL: 'API_EXTERNAL_URL=http://localhost:8000',
+    SITE_URL: 'SITE_URL=http://localhost:3000',
+    NEXT_PUBLIC_URL: 'NEXT_PUBLIC_URL=http://localhost:3000',
+    NEXT_PUBLIC_IS_SANDBOX: 'NEXT_PUBLIC_IS_SANDBOX=true',
+    CRON_SECRET: `CRON_SECRET=${cronSecret}`,
+    DRAFT_MODE_SECRET: `DRAFT_MODE_SECRET=${draftSecret}`,
+    REVALIDATE_SECRET_TOKEN: `REVALIDATE_SECRET_TOKEN=${revalidateSecret}`,
+    MINIO_ROOT_USER: `MINIO_ROOT_USER=${minioUser}`,
+    MINIO_ROOT_PASSWORD: `MINIO_ROOT_PASSWORD=${minioPassword}`,
+    STORAGE_BUCKET: `STORAGE_BUCKET=${bucket}`,
+    R2_ACCOUNT_ID: 'R2_ACCOUNT_ID=minio',
+    R2_REGION: 'R2_REGION=us-east-1',
+    R2_S3_ENDPOINT: 'R2_S3_ENDPOINT=http://minio:9000',
+    // Storage URLs use 127.0.0.1 (NOT localhost) on purpose: on localhost, cookies aren't
+    // port-scoped, so the browser would send the app's Supabase auth cookies to MinIO too — and
+    // MinIO rejects oversized header sets (MetadataTooLarge), breaking image display once cookies
+    // grow. 127.0.0.1 is a different cookie host, so the browser never sends them there.
+    R2_S3_PUBLIC_ENDPOINT: 'R2_S3_PUBLIC_ENDPOINT=http://127.0.0.1:9000',
+    R2_FORCE_PATH_STYLE: 'R2_FORCE_PATH_STYLE=true',
+    NEXT_PUBLIC_R2_BASE_URL: `NEXT_PUBLIC_R2_BASE_URL=http://127.0.0.1:9000/${bucket}`,
+    NEXT_PUBLIC_R2_PUBLIC_URL: `NEXT_PUBLIC_R2_PUBLIC_URL=http://127.0.0.1:9000/${bucket}`,
+    NEXT_PUBLIC_TURNSTILE_SITE_KEY: `NEXT_PUBLIC_TURNSTILE_SITE_KEY=${turnstileSiteKey}`,
+    TURNSTILE_SECRET_KEY: `TURNSTILE_SECRET_KEY=${turnstileSecretKey}`,
+    GOTRUE_MAILER_AUTOCONFIRM: `GOTRUE_MAILER_AUTOCONFIRM=${mailerAutoconfirm}`,
+    SMTP_HOST: `SMTP_HOST=${smtp.host}`,
+    SMTP_PORT: `SMTP_PORT=${smtp.port}`,
+    SMTP_USER: `SMTP_USER=${smtp.user}`,
+    SMTP_PASS: `SMTP_PASS=${smtp.pass}`,
+    SMTP_FROM_EMAIL: `SMTP_FROM_EMAIL=${smtp.fromEmail}`,
+    SMTP_FROM_NAME: `SMTP_FROM_NAME=${smtp.fromName}`,
+  };
+
+  const seed = existing || '# Generated by `npm run docker:setup` — local self-hosted secrets. Do not commit.\n';
+  let nextEnv = upsertEnv(seed, replacements);
+  if (!nextEnv.endsWith('\n')) nextEnv += '\n';
+  await writeFile(ENV_PATH, nextEnv, 'utf8');
+  console.log('✓ Wrote .env (Postgres, JWT secret + signed anon/service keys, MinIO, app secrets).\n');
+
+  // A brand-new .env means brand-new secrets. Postgres only runs its init scripts (which set role
+  // passwords) on an EMPTY volume, so a leftover volume from a previous install would keep the old
+  // credentials and GoTrue/PostgREST could not log in. Reset volumes when the config is fresh.
+  if (!existing) {
+    console.log('Fresh configuration — clearing any previous local sandbox volume so the database matches the new credentials...');
+    try {
+      await run(compose.cmd, [...compose.args, 'down', '-v'], { cwd: PROJECT_ROOT });
+    } catch {
+      /* nothing to tear down */
+    }
+  }
+
+  console.log('Building and starting the stack (first run pulls images + builds the app — a few minutes)...');
+  await run(compose.cmd, [...compose.args, 'up', '-d', '--build'], { cwd: PROJECT_ROOT });
+
+  console.log('\n🎉 Stack is up!');
+  console.log('  1. Open the app:    http://localhost:3000');
+  console.log('  2. Create account:  http://localhost:3000/sign-up  (first sign-up becomes ADMIN)');
+  console.log(
+    mailerAutoconfirm === 'true'
+      ? '     No SMTP → your account is auto-confirmed; just sign in.'
+      : '     Click the confirmation link emailed by your SMTP provider.',
+  );
+  console.log('  3. Supabase API:    http://localhost:8000    MinIO console: http://localhost:9001');
+  const composeStr = `${compose.cmd} ${compose.args.join(' ')}`.trim();
+  console.log(`\n  Logs: ${composeStr} logs -f nextblock-cms   |   Stop: ${composeStr} down   (add -v to wipe data)`);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.8.11",
+  "version": "0.9.5",
   "description": "",
   "main": "index.js",
   "bin": {

package/scripts/sync-template.js

@@ -13,6 +13,9 @@ const TARGET_DIR = resolve(PROJECT_ROOT, 'templates/nextblock-template');
 const REPO_ROOT = resolve(PROJECT_ROOT, '..', '..');
 const ROOT_DOCS_DIR = resolve(REPO_ROOT, 'docs');
 const ROOT_PACKAGE_JSON = resolve(REPO_ROOT, 'package.json');
+// Hand-maintained standalone Docker assets (Dockerfile, docker-compose.yml, docker/**, the
+// zero-dep scripts/docker-setup.mjs) that ship into every generated project for Docker mode.
+const DOCKER_TEMPLATE_DIR = resolve(PROJECT_ROOT, 'docker-template');
 const UI_GLOBALS_SOURCE = resolve(
   PROJECT_ROOT,
   '../../libs/ui/src/styles/globals.css',
@@ -96,6 +99,7 @@ async function ensureTemplateSync() {
   await ensureUiProxies();
   await removeBackups();
   await syncPackageVersions();
+  await ensureDockerAssets();
   await removeTemplateProjectJson();
 
   console.log(chalk.green('Template sync complete.'));
@@ -335,6 +339,31 @@ async function removeTemplateProjectJson() {
   await fs.remove(projectJsonPath).catch(() => undefined);
 }
 
+// Copy the standalone Docker assets into the template and register the docker:* npm scripts so a
+// generated project can run `npm run docker:setup` for the one-click local self-hosted sandbox.
+async function ensureDockerAssets() {
+  if (!(await fs.pathExists(DOCKER_TEMPLATE_DIR))) {
+    return;
+  }
+
+  console.log(chalk.blue('Adding Docker self-hosted assets to the template'));
+  await fs.copy(DOCKER_TEMPLATE_DIR, TARGET_DIR, {
+    overwrite: true,
+    dereference: true,
+  });
+
+  const pkgPath = resolve(TARGET_DIR, 'package.json');
+  if (await fs.pathExists(pkgPath)) {
+    const pkg = await fs.readJson(pkgPath);
+    pkg.scripts = pkg.scripts || {};
+    pkg.scripts['docker:setup'] = 'node scripts/docker-setup.mjs';
+    pkg.scripts['docker:up'] = 'docker compose up -d --build';
+    pkg.scripts['docker:down'] = 'docker compose down';
+    pkg.scripts['docker:logs'] = 'docker compose logs -f nextblock-cms';
+    await fs.writeJson(pkgPath, pkg, { spaces: 2 });
+  }
+}
+
 async function syncPackageVersions() {
   const targetPackageJsonPath = resolve(TARGET_DIR, 'package.json');
   const sourcePackageJsonPath = resolve(SOURCE_DIR, 'package.json');

package/templates/nextblock-template/.dockerignore

@@ -0,0 +1,23 @@
+# Keep the build context lean; deps are reinstalled in the image and secrets stay out.
+node_modules
+.git
+.github
+.next
+out
+dist
+coverage
+tmp
+backup
+backups
+*.log
+npm-debug.log*
+
+# Secrets never enter the image (NEXT_PUBLIC_* arrive as build args).
+.env
+.env.*
+!.env.docker.example
+
+# Not needed inside the app image (mounted/used by other compose services instead).
+docker
+supabase/.branches
+supabase/.temp

package/templates/nextblock-template/Dockerfile

@@ -0,0 +1,85 @@
+# syntax=docker/dockerfile:1.7
+#
+# Production image for a standalone NextBlock CMS project (single Next.js app, not a monorepo).
+# Built with Next.js standalone output, gated on DOCKER_BUILD so a normal `npm run build` / a
+# Vercel deploy is unaffected. Driven by docker-compose.yml (`npm run docker:setup`).
+
+###############################################################################
+# Stage 1 — deps
+###############################################################################
+FROM node:22-alpine AS deps
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+COPY package.json ./
+RUN npm install --no-audit --no-fund
+
+###############################################################################
+# Stage 2 — builder (Next.js standalone output)
+###############################################################################
+FROM node:22-alpine AS builder
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+ENV NEXT_TELEMETRY_DISABLED=1 \
+    CI=true \
+    DOCKER_BUILD=true \
+    NODE_ENV=production
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+# NEXT_PUBLIC_* values are inlined into the browser bundle at build time. Server-only secrets are
+# NOT baked in — they arrive at runtime from docker-compose.yml.
+ARG NEXT_PUBLIC_SUPABASE_URL
+ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
+ARG NEXT_PUBLIC_URL
+ARG NEXT_PUBLIC_R2_PUBLIC_URL
+ARG NEXT_PUBLIC_R2_BASE_URL
+ARG NEXT_PUBLIC_TURNSTILE_SITE_KEY
+ARG NEXT_PUBLIC_IS_SANDBOX
+ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL \
+    NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY \
+    NEXT_PUBLIC_URL=$NEXT_PUBLIC_URL \
+    NEXT_PUBLIC_R2_PUBLIC_URL=$NEXT_PUBLIC_R2_PUBLIC_URL \
+    NEXT_PUBLIC_R2_BASE_URL=$NEXT_PUBLIC_R2_BASE_URL \
+    NEXT_PUBLIC_TURNSTILE_SITE_KEY=$NEXT_PUBLIC_TURNSTILE_SITE_KEY \
+    NEXT_PUBLIC_IS_SANDBOX=$NEXT_PUBLIC_IS_SANDBOX
+
+RUN npm run build
+
+###############################################################################
+# Stage 3 — runner (hardened, non-root)
+###############################################################################
+FROM node:22-alpine AS runner
+WORKDIR /app
+RUN apk add --no-cache libc6-compat socat \
+    && addgroup -g 1001 -S nodejs \
+    && adduser -u 1001 -S nextjs -G nodejs
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    HOSTNAME=0.0.0.0 \
+    # ipv4first so localhost resolves to the socat IPv4 listener; the larger header limit absorbs
+    # Supabase auth cookies (on localhost they aren't port-scoped, so they pile onto every request).
+    NODE_OPTIONS="--dns-result-order=ipv4first --max-http-header-size=65536"
+
+# A single-app project traces to its own root, so server.js sits at the top of .next/standalone.
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+# Loopback proxy: the browser-facing localhost URLs (Supabase :8000, MinIO :9000) are inlined into
+# the build, but server-side code + next/image run INSIDE this container. Forward those ports to the
+# compose services so SSR + image optimization work, and so the Supabase auth cookie key (derived
+# from the URL host) matches between browser and server. Override targets with LOOPBACK_PROXIES.
+RUN printf '%s\n' \
+  '#!/bin/sh' \
+  'set -e' \
+  ': "${LOOPBACK_PROXIES:=8000:kong:8000 9000:minio:9000}"' \
+  'for p in $LOOPBACK_PROXIES; do' \
+  '  socat "TCP4-LISTEN:${p%%:*},fork,reuseaddr,bind=127.0.0.1" "TCP:${p#*:}" 2>/dev/null &' \
+  'done' \
+  'exec node "$(cat .server-entry 2>/dev/null || echo server.js)"' \
+  > /app/docker-entrypoint.sh && chmod +x /app/docker-entrypoint.sh
+
+USER nextjs
+EXPOSE 3000
+ENTRYPOINT ["/app/docker-entrypoint.sh"]

package/templates/nextblock-template/app/[slug]/page.tsx

@@ -38,6 +38,11 @@ interface PageTranslation {
 }
 
 export async function generateStaticParams(): Promise<ResolvedPageParams[]> {
+  // Unconfigured instance (pre-/setup): no DB to read slugs from.
+  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
+    return [];
+  }
+
   const supabase = getSsgSupabaseClient();
   const { data: pages, error } = await supabase
     .from("pages")