create-tigra 3.0.2 → 3.0.5

package/template/client/package.json

@@ -3,16 +3,18 @@
   "version": "0.1.0",
   "private": true,
   "scripts": {
-    "dev": "next dev",
+    "dev": "node ./scripts/next-dev.cjs",
     "build": "next build",
     "start": "next start",
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
+    "audit": "npm audit --audit-level=high",
     "generate:env": "node -e \"import('fs').then(f=>{if(f.existsSync('.env'))console.log('.env already exists, skipping');else{f.copyFileSync('.env.example','.env');console.log('.env created from .env.example')}})\""
   },
   "dependencies": {
     "@hookform/resolvers": "^5.2.2",
     "@reduxjs/toolkit": "^2.11.2",
+    "@sentry/nextjs": "^10.62.0",
     "@tanstack/react-query": "^5.90.21",
     "axios": "^1.13.5",
     "class-variance-authority": "^0.7.1",

package/template/client/scripts/next-dev.cjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+"use strict";
+
+const { spawn } = require("node:child_process");
+
+const DEFAULT_MAX_OLD_SPACE_SIZE = "768";
+const nextBin = require.resolve("next/dist/bin/next");
+
+function applyOldSpaceLimit(nodeOptions, sizeMb) {
+  if (/(^|\s)--max[-_]old[-_]space[-_]size(=|\s|$)/.test(nodeOptions)) {
+    return nodeOptions;
+  }
+
+  return [nodeOptions, `--max-old-space-size=${sizeMb}`].filter(Boolean).join(" ").trim();
+}
+
+const env = { ...process.env };
+env.NEXT_DISABLE_MEM_OVERRIDE = "1";
+env.NODE_OPTIONS = applyOldSpaceLimit(
+  env.NODE_OPTIONS || "",
+  env.NEXT_DEV_MAX_OLD_SPACE_SIZE || DEFAULT_MAX_OLD_SPACE_SIZE,
+);
+
+const args = [
+  nextBin,
+  "dev",
+  "--webpack",
+  "--disable-source-maps",
+  "--no-server-fast-refresh",
+  ...process.argv.slice(2),
+];
+
+const child = spawn(process.execPath, args, { stdio: "inherit", env });
+
+child.on("error", (error) => {
+  console.error(error);
+  process.exit(1);
+});
+
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+
+  process.exit(code ?? 0);
+});

package/template/client/src/app/layout.tsx

@@ -1,3 +1,4 @@
+import { headers } from 'next/headers';
 import type { Metadata, Viewport } from 'next';
 import type React from 'react';
 import { Inter, JetBrains_Mono } from 'next/font/google';
@@ -27,15 +28,21 @@ export const viewport: Viewport = {
   viewportFit: 'cover',
 };
 
-export default function RootLayout({
+export default async function RootLayout({
   children,
 }: Readonly<{
   children: React.ReactNode;
-}>): React.ReactElement {
+}>): Promise<React.ReactElement> {
+  // Read the per-request nonce set by middleware. next-themes injects an inline
+  // anti-FOUC <script> via dangerouslySetInnerHTML that Next does NOT auto-nonce,
+  // so under our 'strict-dynamic' CSP it must be passed the nonce explicitly or
+  // the browser refuses it (causing a flash / hydration mismatch).
+  const nonce = (await headers()).get('x-nonce') ?? undefined;
+
   return (
     <html lang="en" suppressHydrationWarning>
       <body className={`${inter.variable} ${jetbrainsMono.variable} font-sans antialiased`}>
-        <Providers>{children}</Providers>
+        <Providers nonce={nonce}>{children}</Providers>
       </body>
     </html>
   );

package/template/client/src/app/providers.tsx

@@ -11,7 +11,15 @@ import { Toaster } from 'sonner';
 import { store } from '@/store';
 import { AuthInitializer } from '@/features/auth/components/AuthInitializer';
 
-export function Providers({ children }: { children: React.ReactNode }): React.ReactElement {
+export function Providers({
+  children,
+  nonce,
+}: {
+  children: React.ReactNode;
+  // Per-request CSP nonce from middleware (via the root layout). Forwarded to
+  // next-themes so its inline anti-FOUC script is allowed under 'strict-dynamic'.
+  nonce?: string;
+}): React.ReactElement {
   const [queryClient] = useState(
     () =>
       new QueryClient({
@@ -30,7 +38,12 @@ export function Providers({ children }: { children: React.ReactNode }): React.Re
   return (
     <ReduxProvider store={store}>
       <QueryClientProvider client={queryClient}>
-        <ThemeProvider attribute="class" defaultTheme="light" enableColorScheme={false}>
+        <ThemeProvider
+          attribute="class"
+          defaultTheme="light"
+          enableColorScheme={false}
+          nonce={nonce}
+        >
           <AuthInitializer>
             {children}
           </AuthInitializer>

package/template/client/src/instrumentation-client.ts

@@ -0,0 +1,38 @@
+/**
+ * Browser instrumentation.
+ *
+ * Keep local dev cold: do not import @sentry/nextjs unless production has a
+ * public DSN. This avoids compiling the Sentry SDK for every local dev server.
+ */
+type SentryNext = typeof import('@sentry/nextjs');
+type RouterTransitionStart = SentryNext['captureRouterTransitionStart'];
+
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN;
+const sentryEnabled = process.env.NODE_ENV === 'production' && Boolean(dsn);
+
+let sentryPromise: Promise<SentryNext> | null = null;
+
+function loadSentry(): Promise<SentryNext | null> {
+  if (!sentryEnabled || !dsn) return Promise.resolve(null);
+
+  sentryPromise ??= import('@sentry/nextjs').then((Sentry) => {
+    Sentry.init({
+      dsn,
+      tracesSampleRate: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
+        ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
+        : 0.1,
+    });
+
+    return Sentry;
+  });
+
+  return sentryPromise;
+}
+
+void loadSentry();
+
+export const onRouterTransitionStart = ((...args: Parameters<RouterTransitionStart>) => {
+  void loadSentry().then((Sentry) => {
+    Sentry?.captureRouterTransitionStart(...args);
+  });
+}) as RouterTransitionStart;

package/template/client/src/instrumentation.ts

@@ -0,0 +1,42 @@
+/**
+ * Server/Edge runtime instrumentation.
+ *
+ * Keep local dev cold: importing @sentry/nextjs at module top-level makes Next
+ * compile the Sentry SDK before the first page, even with no DSN.
+ */
+type SentryNext = typeof import('@sentry/nextjs');
+type RequestErrorHandler = SentryNext['captureRequestError'];
+
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN ?? process.env.SENTRY_DSN;
+const sentryEnabled = process.env.NODE_ENV === 'production' && Boolean(dsn);
+
+const tracesSampleRate = process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
+  ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
+  : 0.1;
+
+let sentryPromise: Promise<SentryNext> | null = null;
+
+function loadSentry(): Promise<SentryNext | null> {
+  if (!sentryEnabled) return Promise.resolve(null);
+  sentryPromise ??= import('@sentry/nextjs');
+  return sentryPromise;
+}
+
+export async function register(): Promise<void> {
+  const Sentry = await loadSentry();
+  if (!Sentry || !dsn) return;
+
+  if (process.env.NEXT_RUNTIME === 'nodejs' || process.env.NEXT_RUNTIME === 'edge') {
+    Sentry.init({
+      dsn,
+      tracesSampleRate,
+      environment: process.env.SENTRY_ENVIRONMENT ?? process.env.NODE_ENV,
+    });
+  }
+}
+
+export const onRequestError = (async (...args: Parameters<RequestErrorHandler>) => {
+  const Sentry = await loadSentry();
+  if (!Sentry) return;
+  return Sentry.captureRequestError(...args);
+}) as RequestErrorHandler;

package/template/client/src/lib/env.ts

@@ -1,19 +1,30 @@
 import { z } from 'zod';
 
-// Every field MUST have a .default() so the dev fallback (envSchema.parse({}))
-// can produce valid defaults when env vars are missing in development.
+// Every required field MUST have a .default() so the dev fallback
+// (envSchema.parse({})) can produce valid defaults when env vars are missing in
+// development. Genuinely optional integrations (e.g. Sentry) use .optional()
+// instead — unset means "disabled", and the build must pass with them absent.
 const envSchema = z.object({
   NEXT_PUBLIC_API_BASE_URL: z
     .string()
     .url('NEXT_PUBLIC_API_BASE_URL must be a valid URL')
     .default('http://localhost:8000/api/v1'),
   NEXT_PUBLIC_APP_NAME: z.string().default('My App'),
+
+  // --- Error Tracking (Optional, Sentry) ---
+  // Inert without a DSN: instrumentation only inits Sentry when this is set.
+  // Optional so `next build` passes with it unset. Never hardcode a DSN.
+  NEXT_PUBLIC_SENTRY_DSN: z.string().url().optional(),
+  // Fraction of transactions sampled for browser performance tracing (0..1).
+  NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE: z.coerce.number().min(0).max(1).optional(),
 });
 
 function validateEnv(): z.infer<typeof envSchema> {
   const result = envSchema.safeParse({
     NEXT_PUBLIC_API_BASE_URL: process.env.NEXT_PUBLIC_API_BASE_URL,
     NEXT_PUBLIC_APP_NAME: process.env.NEXT_PUBLIC_APP_NAME,
+    NEXT_PUBLIC_SENTRY_DSN: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE,
   });
 
   if (!result.success) {

package/template/client/src/middleware.ts

@@ -14,9 +14,94 @@ function isTokenExpired(token: string): boolean {
   }
 }
 
+/**
+ * Derive the origin (scheme://host[:port]) of a URL, falling back to the input
+ * when it can't be parsed. Used to turn NEXT_PUBLIC_API_BASE_URL (which may
+ * carry a path like .../api/v1) and the Sentry DSN into bare CSP source values.
+ */
+function toOrigin(url: string | undefined): string | null {
+  if (!url) return null;
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+
+const apiOrigin = toOrigin(process.env.NEXT_PUBLIC_API_BASE_URL) ?? 'http://localhost:8000';
+// When Sentry is configured, its browser SDK POSTs envelopes to the DSN origin;
+// it must be allowed in connect-src or every error report is blocked by CSP.
+const sentryOrigin = toOrigin(process.env.NEXT_PUBLIC_SENTRY_DSN);
+
+/**
+ * Build the per-request Content-Security-Policy. A fresh nonce is minted for
+ * every request and threaded onto Next's own scripts (see middleware below), so
+ * 'strict-dynamic' can trust them while refusing any attacker-injected inline
+ * script that lacks the nonce.
+ *
+ * DEV relaxes script-src with 'unsafe-eval' (Next's HMR/react-refresh evals) and
+ * style-src with 'unsafe-inline' (the dev overlay injects inline styles). PROD
+ * is strict. Style-src keeps 'unsafe-inline' in PROD too: Tailwind v4 and some
+ * libraries emit inline <style>/style="" that a nonce cannot cover and that a
+ * strict style-src would REFUSE, breaking the page. Inline styles cannot
+ * exfiltrate data the way inline scripts can, so this is an accepted tradeoff —
+ * the high-value half (the strict, nonce-gated script-src) stays intact.
+ */
+function buildCsp(nonce: string, isProd: boolean): string {
+  const connectSrc = ["'self'", apiOrigin, sentryOrigin].filter(Boolean).join(' ');
+
+  const scriptSrc = isProd
+    ? `'self' 'nonce-${nonce}' 'strict-dynamic' https:`
+    : `'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-eval' https:`;
+
+  // 'unsafe-inline' in style-src in BOTH modes (see note above).
+  const styleSrc = `'self' 'unsafe-inline'`;
+
+  return [
+    `default-src 'self'`,
+    `script-src ${scriptSrc}`,
+    `style-src ${styleSrc}`,
+    `img-src 'self' blob: data: ${apiOrigin}`,
+    `font-src 'self'`,
+    `connect-src ${connectSrc}`,
+    `object-src 'none'`,
+    `base-uri 'none'`,
+    `form-action 'self'`,
+    `frame-ancestors 'none'`,
+    `upgrade-insecure-requests`,
+  ].join('; ');
+}
+
+/**
+ * Attach the static security headers shared by every response. HSTS is
+ * deliberately NOT set here — it is managed at the Cloudflare edge.
+ */
+function applySecurityHeaders(response: NextResponse): NextResponse {
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+  // Redundant with frame-ancestors 'none' but harmless for legacy browsers.
+  response.headers.set('X-Frame-Options', 'DENY');
+  return response;
+}
+
 export function middleware(request: NextRequest): NextResponse {
   const { pathname } = request.nextUrl;
 
+  const isProd = process.env.NODE_ENV === 'production';
+
+  // --- Per-request nonce + CSP (canonical Next.js pattern) ---
+  // base64-encoded random UUID. Minted fresh per request so 'strict-dynamic'
+  // only trusts scripts we (and Next) emit this request.
+  const nonce = Buffer.from(crypto.randomUUID()).toString('base64');
+  const cspHeader = buildCsp(nonce, isProd);
+
+  // Propagate the nonce + CSP on the REQUEST headers. Next reads the CSP from
+  // the request to extract the nonce and stamps it onto its own <script> tags;
+  // without this, strict-dynamic would refuse Next's scripts and break the page.
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.set('x-nonce', nonce);
+  requestHeaders.set('content-security-policy', cspHeader);
+
   // NOTE: This middleware only checks COOKIE PRESENCE (and a best-effort,
   // unverified exp claim) for UX-level routing — redirecting users who are
   // obviously logged out away from protected pages. It does NOT verify the
@@ -29,36 +114,38 @@ export function middleware(request: NextRequest): NextResponse {
   const isProtectedPath = protectedPaths.some((path) => pathname.startsWith(path));
 
   if (isProtectedPath) {
-    // No access_token AND no auth_session — truly unauthenticated
+    // No access_token AND no auth_session — truly unauthenticated.
     if (!accessToken && !authSession) {
       const loginUrl = new URL('/login', request.url);
       loginUrl.searchParams.set('from', pathname);
-      return NextResponse.redirect(loginUrl);
+      const redirect = NextResponse.redirect(loginUrl);
+      redirect.headers.set('content-security-policy', cspHeader);
+      return applySecurityHeaders(redirect);
     }
+  }
 
-    // No access_token BUT auth_session exists — session is alive,
-    // let through so client-side can do getMe() → 401 → refresh → retry
-    if (!accessToken && authSession) {
-      return NextResponse.next();
-    }
+  // Single .next() response carrying the propagated request headers, the CSP
+  // (also on the response, for the browser), and the static security headers.
+  const response = NextResponse.next({ request: { headers: requestHeaders } });
+  response.headers.set('content-security-policy', cspHeader);
+  applySecurityHeaders(response);
 
-    // Expired access_token — delete stale cookie, let through for client-side refresh
+  if (isProtectedPath) {
+    // No access_token BUT auth_session exists — session is alive, let through
+    // so client-side can do getMe() → 401 → refresh → retry.
+    // (response already passes through; nothing extra needed here.)
+
+    // Expired access_token — delete stale cookie, let through for client refresh.
     if (accessToken && isTokenExpired(accessToken)) {
-      const response = NextResponse.next();
       response.cookies.delete('access_token');
-      return response;
     }
-
-    return NextResponse.next();
   }
 
-  return NextResponse.next();
+  return response;
 }
 
 export const config = {
-  matcher: [
-    '/dashboard/:path*',
-    '/profile/:path*',
-    '/admin/:path*',
-  ],
+  // Apply security headers site-wide, but skip Next's static assets and the
+  // favicon (no CSP needed on immutable static files / images).
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
 };

package/template/server/.env.example

@@ -129,6 +129,18 @@ REQUIRE_USER_VERIFICATION=true
 # Maximum file upload size in MB (default: 10)
 MAX_FILE_SIZE_MB=10
 
+# Two-tier upload storage. BOTH optional — leave unset to use the defaults
+# (<cwd>/uploads/public and <cwd>/uploads/private).
+#   PUBLIC  tier: served as static files at /uploads/ — viewable by ANYONE,
+#                 including unauthenticated users (e.g. avatars). @fastify/static
+#                 is scoped to ONLY this dir so it can never serve a private file.
+#   PRIVATE tier: lives OUTSIDE the static root; served ONLY through the
+#                 auth-gated, owner-scoped route GET /api/v1/files/:filename.
+# Both must live UNDER the Coolify uploads volume (/app/uploads/...) so files
+# survive redeploys — see COOLIFY PERSISTENT STORAGE below.
+# UPLOAD_PUBLIC_DIR=/app/uploads/public
+# UPLOAD_PRIVATE_DIR=/app/uploads/private
+
 # COOLIFY PERSISTENT STORAGE (required for uploads to survive redeployments):
 # Go to your service in Coolify → Storages → Add Volume Mount:
 #   Name:             uploads (or <project-name>-uploads)
@@ -243,6 +255,15 @@ LOG_LEVEL=info
 
 # Sentry DSN for error tracking and monitoring
 # Get your DSN from: https://sentry.io/settings/projects/
-# Leave empty to disable Sentry
+# Leave empty to disable Sentry — with no DSN, init is a no-op (fully inert).
+# COOLIFY: Runtime only. Do NOT check "Available at Buildtime".
 # Example: SENTRY_DSN="https://examplePublicKey@o0.ingest.sentry.io/0"
 # SENTRY_DSN=""
+
+# Fraction of transactions sampled for performance tracing (0.0–1.0, default 0.1).
+# Only takes effect when SENTRY_DSN is set.
+# SENTRY_TRACES_SAMPLE_RATE=0.1
+
+# Environment tag attached to Sentry events (e.g. production, staging).
+# Defaults to NODE_ENV when unset.
+# SENTRY_ENVIRONMENT=""

package/template/server/.env.example.production

@@ -122,6 +122,15 @@ REQUIRE_USER_VERIFICATION=true
 # Maximum file upload size in MB
 MAX_FILE_SIZE_MB=10
 
+# Two-tier upload storage. BOTH optional — defaults are <cwd>/uploads/public and
+# <cwd>/uploads/private. Keep them UNDER /app/uploads (the Coolify volume below)
+# so files survive redeploys.
+#   PUBLIC  tier: static files at /uploads/ — viewable by ANYONE (e.g. avatars).
+#   PRIVATE tier: OUTSIDE the static root; served ONLY via the auth-gated,
+#                 owner-scoped route GET /api/v1/files/:filename.
+# UPLOAD_PUBLIC_DIR=/app/uploads/public
+# UPLOAD_PRIVATE_DIR=/app/uploads/private
+
 # COOLIFY PERSISTENT STORAGE (required for uploads to survive redeployments):
 # Go to your service in Coolify → Storages → Add Volume Mount:
 #   Name:             uploads (or <project-name>-uploads)
@@ -199,10 +208,16 @@ LOG_LEVEL=info
 # ERROR TRACKING
 # ===================================================================
 
-# Sentry for production error monitoring
+# Sentry for production error monitoring (leave unset to disable — fully inert)
 # Get your DSN from: https://sentry.io/settings/projects/
 SENTRY_DSN="https://YOUR_PUBLIC_KEY@o0.ingest.sentry.io/YOUR_PROJECT_ID"
 
+# Fraction of transactions sampled for performance tracing (0.0–1.0, default 0.1).
+SENTRY_TRACES_SAMPLE_RATE=0.1
+
+# Environment tag on Sentry events (defaults to NODE_ENV when unset).
+SENTRY_ENVIRONMENT=production
+
 # ===================================================================
 # PRODUCTION CHECKLIST
 # ===================================================================

package/template/server/Dockerfile

@@ -1,12 +1,16 @@
+# syntax=docker/dockerfile:1
 # ===================================================================
 # Multi-stage Dockerfile for Production Deployment
 # Optimized for Coolify, Docker Compose, and Kubernetes
 # ===================================================================
+# BuildKit cache mounts (--mount=type=cache) keep the npm download cache warm
+# ACROSS builds, so a lockfile-change rebuild re-installs without re-downloading.
+# Requires the `# syntax` line above; auto-enabled on Docker 23+ / any BuildKit.
 
 # ===================================================================
 # Stage 1: Dependencies (cached layer)
 # ===================================================================
-FROM node:20-alpine AS dependencies
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS dependencies
 
 # Install production dependencies only
 WORKDIR /app
@@ -15,7 +19,8 @@ WORKDIR /app
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
 # Install dependencies (use the lockfile that exists)
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --prod --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --production --frozen-lockfile; \
@@ -32,13 +37,13 @@ RUN if [ -f pnpm-lock.yaml ]; then \
 # --no-save keeps package.json and the lockfile untouched. Because this stage
 # runs on the same Alpine (musl) base as the runtime stage, the engine binaries
 # downloaded here are the correct ones for production.
-RUN npm install --no-save --no-audit --no-fund \
+RUN --mount=type=cache,target=/root/.npm npm install --no-save --no-audit --no-fund \
       "prisma@$(node -p "require('@prisma/client/package.json').version")"
 
 # ===================================================================
 # Stage 2: Build (compile TypeScript)
 # ===================================================================
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 
 # Override NODE_ENV to ensure devDependencies are installed.
 # Coolify may inject NODE_ENV=production as a build arg, which causes npm ci
@@ -50,7 +55,8 @@ WORKDIR /app
 # Copy package files and install ALL dependencies (including dev)
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --frozen-lockfile; \
@@ -70,7 +76,7 @@ RUN npm run build
 # ===================================================================
 # Stage 3: Production Runtime
 # ===================================================================
-FROM node:20-alpine AS production
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS production
 
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
@@ -96,8 +102,10 @@ COPY --from=builder --chown=nodejs:nodejs /app/package.json ./package.json
 # Copy Prisma files (needed for migrations)
 COPY --from=builder --chown=nodejs:nodejs /app/prisma ./prisma
 
-# Create uploads directory with correct ownership (must be before USER nodejs)
-RUN mkdir -p /app/uploads && chown nodejs:nodejs /app/uploads
+# Create BOTH upload tiers with correct ownership (must be before USER nodejs).
+# public/ is served as static files at /uploads/; private/ is served ONLY via
+# the auth-gated route GET /api/v1/files/:filename. See file-storage.service.ts.
+RUN mkdir -p /app/uploads/public /app/uploads/private && chown -R nodejs:nodejs /app/uploads
 
 # Switch to non-root user
 USER nodejs