create-nextblock 0.8.11 → 0.9.5

package/templates/nextblock-template/app/setup/layout.tsx

@@ -0,0 +1,13 @@
+// Minimal layout for the first-boot wizard. Deliberately does NO Supabase work so it
+// renders even on a completely unconfigured instance. (It is still nested inside the
+// root layout, which short-circuits its own data loading when unconfigured.)
+import type { ReactNode } from 'react';
+
+export const metadata = {
+  title: 'Set up NextBlock',
+  robots: { index: false, follow: false },
+};
+
+export default function SetupLayout({ children }: { children: ReactNode }) {
+  return <div className="mx-auto w-full max-w-3xl px-4 py-10 sm:py-16">{children}</div>;
+}

package/templates/nextblock-template/app/setup/page.tsx

@@ -0,0 +1,103 @@
+import { redirect } from 'next/navigation';
+import { createClient } from '@nextblock-cms/db/server';
+import {
+  detectChannel,
+  isLocalWritableEnv,
+  isSupabaseConfigured,
+  type DeployChannel,
+} from '../../lib/setup/env-status';
+import { getProvisioningStatus } from '../../lib/setup/provisioning';
+import SetupWizard, { type StoragePrefill } from './SetupWizard';
+
+// Always evaluate live: the wizard's whole job is to react to the current env state.
+export const dynamic = 'force-dynamic';
+
+function buildStoragePrefill(channel: DeployChannel, supabaseUrl: string): StoragePrefill {
+  if (channel === 'docker') {
+    // The Docker stack ships MinIO as the S3 backend; docker-setup wrote these already.
+    return {
+      kind: 'minio',
+      readOnly: true,
+      accountId: process.env.R2_ACCOUNT_ID ?? 'minio',
+      bucket: process.env.STORAGE_BUCKET ?? process.env.R2_BUCKET_NAME ?? 'media',
+      endpoint: process.env.R2_S3_ENDPOINT ?? 'http://minio:9000',
+      publicUrl: process.env.NEXT_PUBLIC_R2_PUBLIC_URL ?? 'http://localhost:9000',
+      baseUrl: process.env.NEXT_PUBLIC_R2_BASE_URL ?? '',
+      accessKeyId: '',
+      secretAccessKey: '',
+    };
+  }
+
+  if (channel === 'vercel') {
+    // One-click Vercel deploys connect to Supabase Storage's S3-compatible endpoint.
+    const base = supabaseUrl.replace(/\/$/, '');
+    return {
+      kind: 'supabase',
+      readOnly: false,
+      accountId: 'supabase',
+      bucket: 'media',
+      endpoint: base ? `${base}/storage/v1/s3` : '',
+      publicUrl: base ? `${base}/storage/v1/object/public` : '',
+      baseUrl: '',
+      accessKeyId: process.env.R2_ACCESS_KEY_ID ?? '',
+      secretAccessKey: '',
+    };
+  }
+
+  // Local: the user brings their own Cloudflare R2 (higher free-tier storage).
+  return {
+    kind: 'r2',
+    readOnly: false,
+    accountId: process.env.R2_ACCOUNT_ID ?? '',
+    bucket: process.env.R2_BUCKET_NAME ?? '',
+    endpoint: '',
+    publicUrl: process.env.NEXT_PUBLIC_R2_PUBLIC_URL ?? '',
+    baseUrl: process.env.NEXT_PUBLIC_R2_BASE_URL ?? '',
+    accessKeyId: process.env.R2_ACCESS_KEY_ID ?? '',
+    secretAccessKey: '',
+  };
+}
+
+export default async function SetupPage() {
+  const status = await getProvisioningStatus();
+
+  // Already finished — there's a first admin. Get out of the wizard.
+  if (status.hasAdmin) {
+    redirect('/cms/dashboard');
+  }
+
+  // A signed-in user never needs the wizard. This also closes the brief window right
+  // after completion where is_admin_created may still be read-stale: the just-created
+  // admin has a session, so send them straight to the CMS. (Only checked when
+  // configured — an unconfigured instance has no real auth.)
+  if (status.configured) {
+    const supabase = createClient();
+    const {
+      data: { user },
+    } = await supabase.auth.getUser();
+    if (user) {
+      redirect('/cms/dashboard');
+    }
+  }
+
+  const channel = detectChannel();
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL ?? '';
+
+  return (
+    <SetupWizard
+      channel={channel}
+      configured={isSupabaseConfigured()}
+      writable={isLocalWritableEnv()}
+      siteUrl={process.env.NEXT_PUBLIC_URL ?? ''}
+      storagePrefill={buildStoragePrefill(channel, supabaseUrl)}
+      smtpPrefill={{
+        host: process.env.SMTP_HOST ?? '',
+        port: process.env.SMTP_PORT ?? '465',
+        user: process.env.SMTP_USER ?? '',
+        fromEmail: process.env.SMTP_FROM_EMAIL ?? '',
+        fromName: process.env.SMTP_FROM_NAME ?? '',
+      }}
+      turnstilePrefill={{ siteKey: process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY ?? '' }}
+    />
+  );
+}

package/templates/nextblock-template/components/AppShell.tsx

@@ -66,8 +66,20 @@ export function AppShell({
 }: AppShellProps) {
   const pathname = usePathname() || '';
   const isCmsRequest = pathname.startsWith('/cms');
+  const isSetupRequest = pathname === '/setup' || pathname.startsWith('/setup/');
   const branding = useMemo(() => ({ logo, siteTitle }), [logo, siteTitle]);
 
+  // The first-boot setup wizard renders on its own clean, chrome-free page: no header
+  // or footer, and crucially no EnvVarWarning — the whole point of /setup is to supply
+  // the very env vars that warning complains about.
+  if (isSetupRequest) {
+    return (
+      <AppBrandingContext.Provider value={branding}>
+        <main className="min-h-screen bg-background">{children}</main>
+      </AppBrandingContext.Provider>
+    );
+  }
+
   return (
     <AppBrandingContext.Provider value={branding}>
       {process.env.NEXT_PUBLIC_IS_SANDBOX === 'true' && !isCmsRequest && <SandboxBanner />}

package/templates/nextblock-template/components/header-auth.tsx

@@ -1,70 +1,32 @@
 'use client';
 
-import { hasPublicEnvVars } from "@nextblock-cms/utils";
-import Link from "next/link";
-import { Avatar, AvatarFallback, AvatarImage } from "@nextblock-cms/ui";
-import { Badge } from "@nextblock-cms/ui";
-import { Button } from "@nextblock-cms/ui";
-import { signOutAction } from "../app/actions";
-import { useAuth } from "../context/AuthContext";
-import { useTranslations } from "@nextblock-cms/utils";
-
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuLabel,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger,
-} from "@nextblock-cms/ui";
+import Link from "next/link";
+import { Avatar, AvatarFallback, AvatarImage } from "@nextblock-cms/ui";
+import { Button } from "@nextblock-cms/ui";
+import { signOutAction } from "../app/actions";
+import { useAuth } from "../context/AuthContext";
+import { useTranslations } from "@nextblock-cms/utils";
+
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from "@nextblock-cms/ui";
 import { User, LogOut, LayoutDashboard } from "lucide-react";
 
-export default function AuthButton() {
-  const { user, profile, isAdmin, isWriter } = useAuth();
-  const { t } = useTranslations();
-  const displayName = profile?.full_name || profile?.github_username || user?.email || null;
-  const showAdminLink = isAdmin || isWriter;
-
-  const handleSignOut = async () => {
-    await signOutAction();
-  };
+export default function AuthButton() {
+  const { user, profile, isAdmin, isWriter } = useAuth();
+  const { t } = useTranslations();
+  const displayName = profile?.full_name || profile?.github_username || user?.email || null;
+  const showAdminLink = isAdmin || isWriter;
+
+  const handleSignOut = async () => {
+    await signOutAction();
+  };
 
-  if (!hasPublicEnvVars) {
-    return (
-      <>
-        <div className="flex gap-4 items-center">
-          <div>
-            <Badge
-              variant={"default"}
-              className="font-normal pointer-events-none"
-            >
-              {t('update_env_file_warning')}
-            </Badge>
-          </div>
-          <div className="flex gap-2">
-            <Button
-              asChild
-              size="sm"
-              variant={"outline"}
-              disabled
-              className="opacity-75 cursor-none pointer-events-none"
-            >
-              <Link href="/sign-in">{t('sign_in')}</Link>
-            </Button>
-            <Button
-              asChild
-              size="sm"
-              variant={"default"}
-              disabled
-              className="opacity-75 cursor-none pointer-events-none"
-            >
-              <Link href="/sign-up">{t('sign_up')}</Link>
-            </Button>
-          </div>
-        </div>
-      </>
-    );
-  }
   return user ? (
     <div className="flex items-center gap-4">
       <DropdownMenu>

package/templates/nextblock-template/docker/db/init/99-jwt.sql

@@ -0,0 +1,6 @@
+-- Expose the JWT secret to Postgres as a database GUC, matching Supabase's setup. Runs once.
+\set jwt_secret `echo "$JWT_SECRET"`
+\set jwt_exp `echo "$JWT_EXP"`
+
+alter database postgres set "app.settings.jwt_secret" to :'jwt_secret';
+alter database postgres set "app.settings.jwt_exp" to :'jwt_exp';

package/templates/nextblock-template/docker/db/init/99-roles.sql

@@ -0,0 +1,25 @@
+-- Self-hosted Supabase role passwords. The supabase/postgres image creates the platform roles;
+-- GoTrue logs in as supabase_auth_admin and PostgREST as authenticator. Give the roles that exist
+-- the generated POSTGRES_PASSWORD (the set varies by image tag, so each is guarded; the password
+-- is passed via a session GUC because psql variables aren't interpolated inside a dollar block).
+-- Runs once on first init.
+\set pgpass `echo "$POSTGRES_PASSWORD"`
+select set_config('nextblock.pgpass', :'pgpass', false);
+
+do $$
+declare
+  role_name text;
+begin
+  foreach role_name in array array[
+    'authenticator',
+    'pgbouncer',
+    'supabase_auth_admin',
+    'supabase_storage_admin',
+    'supabase_functions_admin',
+    'supabase_read_only_user'
+  ] loop
+    if exists (select 1 from pg_roles where rolname = role_name) then
+      execute format('alter role %I with password %L', role_name, current_setting('nextblock.pgpass'));
+    end if;
+  end loop;
+end $$;

package/templates/nextblock-template/docker/kong/kong.yml

@@ -0,0 +1,112 @@
+# Kong declarative (DB-less) gateway config for the NextBlock self-hosted stack.
+#
+# $SUPABASE_ANON_KEY and $SUPABASE_SERVICE_KEY are substituted at container start by the kong
+# service entrypoint (docker-compose.yml) from the generated ANON_KEY / SERVICE_ROLE_KEY env.
+# Trimmed to just the Auth (GoTrue) and PostgREST routes the app uses.
+_format_version: '2.1'
+_transform: true
+
+consumers:
+  - username: anon
+    keyauth_credentials:
+      - key: $SUPABASE_ANON_KEY
+  - username: service_role
+    keyauth_credentials:
+      - key: $SUPABASE_SERVICE_KEY
+
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+services:
+  - name: auth-v1-open
+    url: http://auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  - name: auth-v1
+    url: http://auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: rest-v1
+    url: http://rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  - name: graphql-v1
+    url: http://rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - 'Content-Profile: graphql_public'
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon

package/templates/nextblock-template/docker/migrate/run-migrations.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Applies the NextBlock SQL migrations (mounted at /migrations) in chronological filename order,
+# once GoTrue has provisioned the auth schema (profiles etc. FK to auth.users). Idempotent: a
+# tracking table records applied versions so restarts never re-run a migration. Each file runs
+# in a single transaction (ON_ERROR_STOP).
+set -eu
+
+PGHOST="${POSTGRES_HOST:-db}"
+PGPORT="${POSTGRES_PORT:-5432}"
+PGUSER="postgres"
+PGDATABASE="${POSTGRES_DB:-postgres}"
+export PGPASSWORD="${POSTGRES_PASSWORD}"
+
+psql_cmd() {
+  psql -v ON_ERROR_STOP=1 -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" "$@"
+}
+
+echo "[migrate] waiting for Postgres at ${PGHOST}:${PGPORT}..."
+until psql_cmd -c 'select 1;' >/dev/null 2>&1; do
+  sleep 2
+done
+
+echo "[migrate] waiting for GoTrue to create auth.users..."
+until [ "$(psql_cmd -tAc "select to_regclass('auth.users') is not null;")" = "t" ]; do
+  sleep 2
+done
+
+psql_cmd -c "create table if not exists public._nextblock_docker_migrations (
+  version text primary key,
+  applied_at timestamptz not null default now()
+);"
+
+applied_any=0
+for file in $(ls /migrations/*.sql | sort); do
+  version="$(basename "$file" .sql)"
+  already="$(psql_cmd -tAc "select 1 from public._nextblock_docker_migrations where version = '${version}';")"
+  if [ "$already" = "1" ]; then
+    echo "[migrate] skip ${version} (already applied)"
+    continue
+  fi
+  echo "[migrate] applying ${version}"
+  psql_cmd --single-transaction -f "$file"
+  psql_cmd -c "insert into public._nextblock_docker_migrations (version) values ('${version}');"
+  applied_any=1
+done
+
+if [ "$applied_any" = "1" ]; then
+  echo "[migrate] migrations applied successfully."
+else
+  echo "[migrate] database already up to date."
+fi

package/templates/nextblock-template/docker-compose.yml

@@ -0,0 +1,219 @@
+# Self-hosted NextBlock CMS stack for a standalone project. Generated/driven by
+# `npm run docker:setup`, which writes the .env this file reads. Mirrors the production Supabase
+# topology: Postgres + GoTrue + PostgREST behind a Kong gateway, plus MinIO for S3 media.
+name: nextblock
+
+services:
+  db:
+    image: ${SUPABASE_DB_IMAGE:-supabase/postgres:15.8.1.085}
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:-postgres}
+      JWT_SECRET: ${JWT_SECRET}
+      JWT_EXP: ${JWT_EXP:-3600}
+    volumes:
+      - nextblock_db_store:/var/lib/postgresql/data
+      - ./docker/db/init/99-roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:ro
+      - ./docker/db/init/99-jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:ro
+    healthcheck:
+      test: ['CMD', 'pg_isready', '-U', 'postgres', '-h', 'localhost']
+      interval: 5s
+      timeout: 5s
+      retries: 12
+      # supabase/postgres runs a heavy first-init; give it time before counting health failures.
+      start_period: 60s
+    ports:
+      - '${POSTGRES_PORT_EXTERNAL:-54322}:5432'
+
+  auth:
+    image: ${SUPABASE_GOTRUE_IMAGE:-supabase/gotrue:v2.189.0}
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      GOTRUE_API_HOST: 0.0.0.0
+      GOTRUE_API_PORT: 9999
+      API_EXTERNAL_URL: ${API_EXTERNAL_URL:-http://localhost:8000}
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}
+      GOTRUE_SITE_URL: ${SITE_URL:-http://localhost:3000}
+      GOTRUE_URI_ALLOW_LIST: '*'
+      GOTRUE_DISABLE_SIGNUP: 'false'
+      GOTRUE_JWT_ADMIN_ROLES: service_role
+      GOTRUE_JWT_AUD: authenticated
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      GOTRUE_JWT_EXP: ${JWT_EXP:-3600}
+      GOTRUE_JWT_SECRET: ${JWT_SECRET}
+      GOTRUE_JWT_ISSUER: ${API_EXTERNAL_URL:-http://localhost:8000}/auth/v1
+      GOTRUE_EXTERNAL_EMAIL_ENABLED: 'true'
+      GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-true}
+      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_FROM_EMAIL:-admin@example.com}
+      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
+      # Must be a valid integer even when SMTP is skipped (GoTrue parses it as int and crashes on
+      # ''). With no host + autoconfirm on, no mail is sent, so the value is otherwise inert.
+      GOTRUE_SMTP_PORT: ${SMTP_PORT:-2500}
+      GOTRUE_SMTP_USER: ${SMTP_USER:-}
+      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
+      GOTRUE_SMTP_SENDER_NAME: ${SMTP_FROM_NAME:-NextBlock}
+      GOTRUE_MAILER_URLPATHS_CONFIRMATION: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_RECOVERY: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_INVITE: /auth/v1/verify
+      GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE: /auth/v1/verify
+    healthcheck:
+      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:9999/health']
+      interval: 5s
+      timeout: 5s
+      retries: 15
+
+  rest:
+    image: ${SUPABASE_POSTGREST_IMAGE:-postgrest/postgrest:v12.2.12}
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-postgres}
+      PGRST_DB_SCHEMAS: public,graphql_public
+      PGRST_DB_ANON_ROLE: anon
+      PGRST_JWT_SECRET: ${JWT_SECRET}
+      PGRST_DB_USE_LEGACY_GUCS: 'false'
+      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
+      PGRST_APP_SETTINGS_JWT_EXP: ${JWT_EXP:-3600}
+      PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
+
+  kong:
+    image: ${SUPABASE_KONG_IMAGE:-kong:2.8.1}
+    restart: unless-stopped
+    depends_on:
+      auth:
+        condition: service_started
+      rest:
+        condition: service_started
+    environment:
+      KONG_DATABASE: 'off'
+      KONG_DECLARATIVE_CONFIG: /home/kong/kong.yml
+      KONG_DNS_ORDER: LAST,A,CNAME
+      KONG_PLUGINS: request-transformer,cors,key-auth,acl
+      KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
+      KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
+      # localhost cookies aren't port-scoped, so the app's Supabase auth cookies are also sent to
+      # Kong on every supabase-js request — give nginx room so they don't 431.
+      KONG_NGINX_HTTP_LARGE_CLIENT_HEADER_BUFFERS: 8 32k
+      SUPABASE_ANON_KEY: ${ANON_KEY}
+      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
+    volumes:
+      - ./docker/kong/kong.yml:/home/kong/temp.yml:ro
+    entrypoint: bash -c 'eval "echo \"$$(cat ~/temp.yml)\"" > ~/kong.yml && /docker-entrypoint.sh kong docker-start'
+    ports:
+      - '${KONG_HTTP_PORT:-8000}:8000'
+
+  minio:
+    image: ${MINIO_IMAGE:-minio/minio:latest}
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+    volumes:
+      - nextblock_media:/data
+    ports:
+      - '${MINIO_S3_PORT:-9000}:9000'
+      - '${MINIO_CONSOLE_PORT:-9001}:9001'
+
+  minio-init:
+    image: ${MINIO_MC_IMAGE:-minio/mc:latest}
+    restart: 'no'
+    depends_on:
+      minio:
+        condition: service_started
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+      STORAGE_BUCKET: ${STORAGE_BUCKET:-nextblock}
+    entrypoint: >
+      /bin/sh -c "
+      until mc alias set local http://minio:9000 $$MINIO_ROOT_USER $$MINIO_ROOT_PASSWORD; do echo 'waiting for minio...'; sleep 2; done &&
+      mc mb --ignore-existing local/$$STORAGE_BUCKET &&
+      mc anonymous set download local/$$STORAGE_BUCKET &&
+      echo 'minio bucket ready'
+      "
+
+  migrate:
+    image: ${MIGRATE_IMAGE:-postgres:15-alpine}
+    restart: 'no'
+    depends_on:
+      db:
+        condition: service_healthy
+      auth:
+        condition: service_healthy
+    environment:
+      POSTGRES_HOST: db
+      POSTGRES_PORT: 5432
+      POSTGRES_DB: ${POSTGRES_DB:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - ./supabase/migrations:/migrations:ro
+      - ./docker/migrate/run-migrations.sh:/run-migrations.sh:ro
+    entrypoint: ['sh', '/run-migrations.sh']
+
+  nextblock-cms:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-http://localhost:8000}
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
+        NEXT_PUBLIC_URL: ${NEXT_PUBLIC_URL:-http://localhost:3000}
+        NEXT_PUBLIC_R2_PUBLIC_URL: ${NEXT_PUBLIC_R2_PUBLIC_URL}
+        NEXT_PUBLIC_R2_BASE_URL: ${NEXT_PUBLIC_R2_BASE_URL}
+        NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY:-}
+        NEXT_PUBLIC_IS_SANDBOX: ${NEXT_PUBLIC_IS_SANDBOX:-true}
+    restart: unless-stopped
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      kong:
+        condition: service_started
+      minio-init:
+        condition: service_completed_successfully
+    environment:
+      NODE_ENV: production
+      PORT: 3000
+      HOSTNAME: 0.0.0.0
+      # Browser AND server both use localhost:8000; the in-container loopback proxy (see Dockerfile)
+      # forwards it to Kong, keeping the host-derived Supabase auth cookie key consistent for SSR.
+      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-http://localhost:8000}
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${ANON_KEY}
+      SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
+      NEXT_PUBLIC_URL: ${NEXT_PUBLIC_URL:-http://localhost:3000}
+      NEXT_PUBLIC_IS_SANDBOX: ${NEXT_PUBLIC_IS_SANDBOX:-true}
+      CRON_SECRET: ${CRON_SECRET}
+      DRAFT_MODE_SECRET: ${DRAFT_MODE_SECRET}
+      REVALIDATE_SECRET_TOKEN: ${REVALIDATE_SECRET_TOKEN}
+      CORTEX_AI_ENCRYPTION_KEY: ${CORTEX_AI_ENCRYPTION_KEY:-}
+      R2_ACCOUNT_ID: ${R2_ACCOUNT_ID:-minio}
+      R2_BUCKET_NAME: ${STORAGE_BUCKET:-nextblock}
+      R2_ACCESS_KEY_ID: ${MINIO_ROOT_USER}
+      R2_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
+      R2_REGION: ${R2_REGION:-us-east-1}
+      R2_S3_ENDPOINT: ${R2_S3_ENDPOINT:-http://minio:9000}
+      R2_S3_PUBLIC_ENDPOINT: ${R2_S3_PUBLIC_ENDPOINT:-http://localhost:9000}
+      R2_FORCE_PATH_STYLE: 'true'
+      NEXT_PUBLIC_R2_PUBLIC_URL: ${NEXT_PUBLIC_R2_PUBLIC_URL}
+      NEXT_PUBLIC_R2_BASE_URL: ${NEXT_PUBLIC_R2_BASE_URL}
+      SMTP_HOST: ${SMTP_HOST:-}
+      SMTP_PORT: ${SMTP_PORT:-}
+      SMTP_USER: ${SMTP_USER:-}
+      SMTP_PASS: ${SMTP_PASS:-}
+      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
+      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-}
+      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
+      NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY:-}
+    ports:
+      - '${APP_PORT:-3000}:3000'
+
+volumes:
+  nextblock_db_store:
+  nextblock_media: