create-tigra 3.0.2 → 3.0.5

package/README.md

@@ -82,6 +82,10 @@ cd my-app/server
 docker compose --profile tools up -d
 ```
 
+## Security and Migration Notes
+
+- [Account deactivation login reactivation: issue, fix, and existing-project migration](docs/account-deactivation-login-reactivation.md)
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-tigra",
-  "version": "3.0.2",
+  "version": "3.0.5",
   "type": "module",
   "description": "Create a production-ready full-stack app with Next.js 16 + Fastify 5 + Prisma + Redis",
   "bin": {

package/template/client/.env.example

@@ -3,3 +3,22 @@ NEXT_PUBLIC_API_BASE_URL=http://localhost:8000/api/v1
 
 # App name displayed in the UI
 NEXT_PUBLIC_APP_NAME={{PROJECT_DISPLAY_NAME}}
+
+# ===================================================================
+# ERROR TRACKING (Optional, Sentry)
+# ===================================================================
+#
+# Leave unset to disable Sentry entirely — instrumentation only inits when a
+# DSN is present, so the build and runtime are fully inert without it.
+# This setup is runtime-only and env-gated: next.config.ts is NOT wrapped with
+# withSentryConfig, so `next build` needs NO Sentry auth token. Source-map
+# upload (withSentryConfig + SENTRY_AUTH_TOKEN) is the opt-in upgrade.
+#
+# Public DSN (safe to expose to the browser). Inits both the browser and the
+# Next.js server/edge runtimes.
+# Example: NEXT_PUBLIC_SENTRY_DSN="https://examplePublicKey@o0.ingest.sentry.io/0"
+# NEXT_PUBLIC_SENTRY_DSN=""
+
+# Fraction of transactions sampled for browser performance tracing (0.0–1.0).
+# Defaults to 0.1 when unset. Only takes effect when the DSN is set.
+# NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE=0.1

package/template/client/Dockerfile

@@ -1,13 +1,18 @@
+# syntax=docker/dockerfile:1
 # ===================================================================
 # Multi-stage Dockerfile for Next.js Production Deployment
 # Optimized for Coolify, Docker Compose, and Kubernetes
 # Requires `output: "standalone"` in next.config.ts
 # ===================================================================
+# BuildKit cache mount (--mount=type=cache) keeps the npm download cache warm
+# across builds, so a lockfile/dep-change rebuild re-installs from cache
+# (measured ~2.8x: 49s->18s on a real create-tigra client) instead of
+# re-downloading every tarball. Requires the `# syntax` line above (BuildKit).
 
 # ===================================================================
 # Stage 1: Dependencies (cached layer)
 # ===================================================================
-FROM node:20-alpine AS dependencies
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS dependencies
 
 WORKDIR /app
 
@@ -15,7 +20,8 @@ WORKDIR /app
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
 # Install dependencies (use the lockfile that exists)
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --frozen-lockfile; \
@@ -26,7 +32,7 @@ RUN if [ -f pnpm-lock.yaml ]; then \
 # ===================================================================
 # Stage 2: Build (compile Next.js)
 # ===================================================================
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 
 WORKDIR /app
 
@@ -49,12 +55,16 @@ ENV NEXT_PUBLIC_APP_NAME=$NEXT_PUBLIC_APP_NAME
 ENV NEXT_TELEMETRY_DISABLED=1
 
 # Build the application (outputs to .next/standalone)
+# NOTE: a `--mount=type=cache,target=/app/.next/cache` was tested here and REMOVED —
+# it measured SLOWER (next build 29s→58s on a real create-tigra client), because Next's
+# persistent-cache serialization overhead exceeds the incremental savings for small/mid
+# apps. Re-add it only for a genuinely large client after measuring a win.
 RUN npm run build
 
 # ===================================================================
 # Stage 3: Production Runtime
 # ===================================================================
-FROM node:20-alpine AS production
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS production
 
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init

package/template/client/next.config.ts

@@ -1,19 +1,12 @@
 import type { NextConfig } from "next";
 
-const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8000";
-const apiOrigin = (() => {
-  try {
-    return new URL(apiBaseUrl).origin;
-  } catch {
-    return "http://localhost:8000";
-  }
-})();
-
-// 'unsafe-eval' is required by Next.js dev mode (HMR/react-refresh) but must
-// NOT ship to production. 'unsafe-inline' stays in both modes — the Next.js
-// inline runtime requires it unless a full nonce infrastructure is added.
-const isDev = process.env.NODE_ENV === "development";
-const scriptSrc = `script-src 'self'${isDev ? " 'unsafe-eval'" : ""} 'unsafe-inline'`;
+// SECURITY HEADERS / CSP NOTE:
+// All security headers — including the Content-Security-Policy — are set in
+// src/middleware.ts, which is the SINGLE SOURCE OF TRUTH for them. The CSP is
+// per-request and nonce-based ('strict-dynamic'), which a static headers() block
+// here cannot express, and emitting a CSP from both places would produce a
+// conflicting duplicate Content-Security-Policy header. Do NOT add a headers()
+// CSP back here. HSTS is managed at the Cloudflare edge.
 
 const nextConfig: NextConfig = {
   output: "standalone",
@@ -24,34 +17,6 @@ const nextConfig: NextConfig = {
     // dynamic: 0 (still unconstrained) is what protects data pages — never raise it.
     staleTimes: { dynamic: 0, static: 30 },
   },
-  async headers() {
-    return [
-      {
-        source: "/(.*)",
-        headers: [
-          { key: "X-Frame-Options", value: "DENY" },
-          { key: "X-Content-Type-Options", value: "nosniff" },
-          { key: "Referrer-Policy", value: "origin-when-cross-origin" },
-          { key: "X-XSS-Protection", value: "1; mode=block" },
-          {
-            key: "Content-Security-Policy",
-            value: [
-              "default-src 'self'",
-              scriptSrc,
-              "style-src 'self' 'unsafe-inline'",
-              `img-src 'self' blob: data: https: ${apiOrigin}`,
-              "font-src 'self'",
-              "object-src 'none'",
-              "base-uri 'self'",
-              "form-action 'self'",
-              "frame-ancestors 'none'",
-              `connect-src 'self' ${apiOrigin}`,
-            ].join("; "),
-          },
-        ],
-      },
-    ];
-  },
 };
 
 export default nextConfig;