create-tigra 3.0.2 → 3.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-tigra",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "type": "module",
   "description": "Create a production-ready full-stack app with Next.js 16 + Fastify 5 + Prisma + Redis",
   "bin": {

package/template/client/.env.example

@@ -3,3 +3,22 @@ NEXT_PUBLIC_API_BASE_URL=http://localhost:8000/api/v1
 
 # App name displayed in the UI
 NEXT_PUBLIC_APP_NAME={{PROJECT_DISPLAY_NAME}}
+
+# ===================================================================
+# ERROR TRACKING (Optional, Sentry)
+# ===================================================================
+#
+# Leave unset to disable Sentry entirely — instrumentation only inits when a
+# DSN is present, so the build and runtime are fully inert without it.
+# This setup is runtime-only and env-gated: next.config.ts is NOT wrapped with
+# withSentryConfig, so `next build` needs NO Sentry auth token. Source-map
+# upload (withSentryConfig + SENTRY_AUTH_TOKEN) is the opt-in upgrade.
+#
+# Public DSN (safe to expose to the browser). Inits both the browser and the
+# Next.js server/edge runtimes.
+# Example: NEXT_PUBLIC_SENTRY_DSN="https://examplePublicKey@o0.ingest.sentry.io/0"
+# NEXT_PUBLIC_SENTRY_DSN=""
+
+# Fraction of transactions sampled for browser performance tracing (0.0–1.0).
+# Defaults to 0.1 when unset. Only takes effect when the DSN is set.
+# NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE=0.1

package/template/client/Dockerfile

@@ -7,7 +7,7 @@
 # ===================================================================
 # Stage 1: Dependencies (cached layer)
 # ===================================================================
-FROM node:20-alpine AS dependencies
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS dependencies
 
 WORKDIR /app
 
@@ -26,7 +26,7 @@ RUN if [ -f pnpm-lock.yaml ]; then \
 # ===================================================================
 # Stage 2: Build (compile Next.js)
 # ===================================================================
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 
 WORKDIR /app
 
@@ -54,7 +54,7 @@ RUN npm run build
 # ===================================================================
 # Stage 3: Production Runtime
 # ===================================================================
-FROM node:20-alpine AS production
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS production
 
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init

package/template/client/next.config.ts

@@ -1,19 +1,12 @@
 import type { NextConfig } from "next";
 
-const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8000";
-const apiOrigin = (() => {
-  try {
-    return new URL(apiBaseUrl).origin;
-  } catch {
-    return "http://localhost:8000";
-  }
-})();
-
-// 'unsafe-eval' is required by Next.js dev mode (HMR/react-refresh) but must
-// NOT ship to production. 'unsafe-inline' stays in both modes — the Next.js
-// inline runtime requires it unless a full nonce infrastructure is added.
-const isDev = process.env.NODE_ENV === "development";
-const scriptSrc = `script-src 'self'${isDev ? " 'unsafe-eval'" : ""} 'unsafe-inline'`;
+// SECURITY HEADERS / CSP NOTE:
+// All security headers — including the Content-Security-Policy — are set in
+// src/middleware.ts, which is the SINGLE SOURCE OF TRUTH for them. The CSP is
+// per-request and nonce-based ('strict-dynamic'), which a static headers() block
+// here cannot express, and emitting a CSP from both places would produce a
+// conflicting duplicate Content-Security-Policy header. Do NOT add a headers()
+// CSP back here. HSTS is managed at the Cloudflare edge.
 
 const nextConfig: NextConfig = {
   output: "standalone",
@@ -24,34 +17,6 @@ const nextConfig: NextConfig = {
     // dynamic: 0 (still unconstrained) is what protects data pages — never raise it.
     staleTimes: { dynamic: 0, static: 30 },
   },
-  async headers() {
-    return [
-      {
-        source: "/(.*)",
-        headers: [
-          { key: "X-Frame-Options", value: "DENY" },
-          { key: "X-Content-Type-Options", value: "nosniff" },
-          { key: "Referrer-Policy", value: "origin-when-cross-origin" },
-          { key: "X-XSS-Protection", value: "1; mode=block" },
-          {
-            key: "Content-Security-Policy",
-            value: [
-              "default-src 'self'",
-              scriptSrc,
-              "style-src 'self' 'unsafe-inline'",
-              `img-src 'self' blob: data: https: ${apiOrigin}`,
-              "font-src 'self'",
-              "object-src 'none'",
-              "base-uri 'self'",
-              "form-action 'self'",
-              "frame-ancestors 'none'",
-              `connect-src 'self' ${apiOrigin}`,
-            ].join("; "),
-          },
-        ],
-      },
-    ];
-  },
 };
 
 export default nextConfig;