Optiomize docker image

.dockerignore

@@ -9,13 +9,6 @@ dist
 build
 .next
 
-# Environment variables
-.env
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
-
 # Logs
 logs
 *.log

.eslintignore

@@ -0,0 +1,3 @@
+.cache
+build
+**/node_modules/**

.eslintrc

@@ -0,0 +1,27 @@
+{
+  "parser": "babel-eslint",
+  "extends": "eslint:recommended",
+  "env": {
+    "commonjs": true,
+    "es6": true,
+    "node": true,
+    "browser": false
+  },
+  "parserOptions": {
+    "ecmaFeatures": {
+      "experimentalObjectRestSpread": true,
+      "jsx": false
+    },
+    "sourceType": "module"
+  },
+  "globals": {
+    "strapi": true
+  },
+  "rules": {
+    "indent": ["error", 2, { "SwitchCase": 1 }],
+    "linebreak-style": ["error", "unix"],
+    "no-console": 0,
+    "quotes": ["error", "single"],
+    "semi": ["error", "always"]
+  }
+}

.gitleaks.toml

@@ -0,0 +1,12 @@
+# This is NOT the default gitleaks config. The default gitleaks config is located
+# here: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
+# This gitleaks config extends the default config and ignores some development paths
+
+title = "Gitleaks"
+[extend]
+useDefault = true
+
+[allowlist]
+paths = [
+  '''^src/extensions/documentation''',
+]

.gitleaksignore

@@ -0,0 +1 @@
+.sample.env:generic-api-key:8

.pre-commit-config.yaml

@@ -0,0 +1,46 @@
+default_install_hook_types:
+  - pre-commit
+  - pre-push
+  - commit-msg
+default_stages:
+  - pre-commit
+  - pre-push
+repos:
+  - hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+    repo: meta
+  - hooks:
+      - args:
+          - --allow-multiple-documents
+        id: check-yaml
+        types: ["yaml"]
+      - id: check-merge-conflict
+      - id: check-toml
+        types: ['toml']
+      - id: check-added-large-files
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+    repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+  - hooks:
+      - id: yamllint
+        args: [--strict, -c=.yamllint]
+        exclude: "(.github|tests|.woodpecker|pnpm-lock.yaml)/.*"
+    repo: https://github.com/adrienverge/yamllint.git
+    rev: v1.37.1
+  - hooks:
+      - id: validate-eslint
+    repo: https://github.com/jordanopensource/pre-commit-hooks
+    rev: v0.4.5
+  - hooks:
+      - id: gitleaks
+        name: detect hardcoded secrets
+    repo: https://github.com/zricethezav/gitleaks
+    rev: v8.26.0
+  - hooks:
+      - id: commitizen
+        stages:
+          - commit-msg
+    repo: https://github.com/commitizen-tools/commitizen
+    rev: v4.7.1

.woodpecker/build-latest-image.yaml

@@ -0,0 +1,84 @@
+when:
+  - event: [push, manual]
+    branch:
+      exclude: [main]
+  - event: [pull_request]
+    evaluate: 'CI_COMMIT_TARGET_BRANCH != "main"'
+
+variables:
+  - &docker_repo 'josaorg/nuha-cms'
+  - &slack_channel 'builds'
+  - &success_message >
+    ✅ *SUCCESS* - Latest Build #{{ build.number }}
+
+    📁 *Repository:* {{ repo.name }}
+    🌿 *Branch:* {{ build.branch }}
+    📝 *Commit:* {{ truncate build.commit 8 }}
+    👤 *Author:* {{ build.author }}
+
+    🔗 *Links:*
+    • <{{ build.link }}|View Build>
+  - &failure_message >
+    ❌ *FAILED* - Latest Build #{{ build.number }}
+
+    📁 *Repository:* {{ repo.name }}
+    🌿 *Branch:* {{ build.branch }}
+    📝 *Commit:* {{ truncate build.commit 8 }}
+    👤 *Author:* {{ build.author }}
+
+    🔗 *Links:*
+    • <{{ build.link }}|View Build>
+
+steps:
+  - name: run-pre-commit-hooks
+    image: josaorg/pre-commit-runner
+    settings:
+      args: '--all-files'
+      skip: 'end-of-file-fixer'
+
+  - name: build-latest-image
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: *docker_repo
+      dockerfile: ./Dockerfile
+      tags:
+        - ${CI_COMMIT_SHA:-latest}
+        - latest
+      username:
+        from_secret: DOCKER_HUB_USERNAME
+      password:
+        from_secret: DOCKER_HUB_PASSWORD
+      build_args:
+        - CI_COMMIT_SHA=${CI_COMMIT_SHA}
+        - CI_REPO_URL=${CI_REPO_URL}
+        - CI_REPO_NAME=${CI_REPO_NAME}
+        - CI_PIPELINE_URL=${CI_PIPELINE_URL}
+        - CI_PIPELINE_CREATED=${CI_PIPELINE_CREATED}
+    depends_on:
+      - run-pre-commit-hooks
+
+  - name: notify-slack-latest-success
+    image: plugins/slack
+    settings:
+      webhook:
+        from_secret: SLACK_WEBHOOK
+      channel: *slack_channel
+      template: *success_message
+    when:
+      - status: success
+    depends_on:
+      - run-pre-commit-hooks
+      - build-latest-image
+
+  - name: notify-slack-latest-failure
+    image: plugins/slack
+    settings:
+      webhook:
+        from_secret: SLACK_WEBHOOK
+      channel: *slack_channel
+      template: *failure_message
+    when:
+      - status: failure
+    depends_on:
+      - run-pre-commit-hooks
+      - build-latest-image

.woodpecker/build-stable-image.yaml

@@ -0,0 +1,85 @@
+when:
+  - event: [push, manual]
+    branch: [main]
+  - event: [pull_request]
+    evaluate: 'CI_COMMIT_TARGET_BRANCH == "main"'
+    branch:
+      exclude: [main]
+
+variables:
+  - &docker_repo 'josaorg/nuha-cms'
+  - &slack_channel 'builds'
+  - &success_message >
+    ✅ *SUCCESS* - Stable Build #{{ build.number }}
+
+    📁 *Repository:* {{ repo.name }}
+    🌿 *Branch:* {{ build.branch }}
+    📝 *Commit:* {{ truncate build.commit 8 }}
+    👤 *Author:* {{ build.author }}
+
+    🔗 *Links:*
+    • <{{ build.link }}|View Build>
+  - &failure_message >
+    ❌ *FAILED* - Stable Build #{{ build.number }}
+
+    📁 *Repository:* {{ repo.name }}
+    🌿 *Branch:* {{ build.branch }}
+    📝 *Commit:* {{ truncate build.commit 8 }}
+    👤 *Author:* {{ build.author }}
+
+    🔗 *Links:*
+    • <{{ build.link }}|View Build>
+
+steps:
+  - name: run-pre-commit-hooks
+    image: josaorg/pre-commit-runner
+    settings:
+      args: '--all-files'
+      skip: 'end-of-file-fixer'
+
+  - name: build-stable-image
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: *docker_repo
+      dockerfile: ./Dockerfile
+      tags:
+        - ${CI_COMMIT_SHA:-latest}
+        - stable
+      username:
+        from_secret: DOCKER_HUB_USERNAME
+      password:
+        from_secret: DOCKER_HUB_PASSWORD
+      build_args:
+        - CI_COMMIT_SHA=${CI_COMMIT_SHA}
+        - CI_REPO_URL=${CI_REPO_URL}
+        - CI_REPO_NAME=${CI_REPO_NAME}
+        - CI_PIPELINE_URL=${CI_PIPELINE_URL}
+        - CI_PIPELINE_CREATED=${CI_PIPELINE_CREATED}N
+    depends_on:
+      - run-pre-commit-hooks
+
+  - name: notify-slack-stable-success
+    image: plugins/slack
+    settings:
+      webhook:
+        from_secret: SLACK_WEBHOOK
+      channel: *slack_channel
+      template: *success_message
+    when:
+      - status: success
+    depends_on:
+      - run-pre-commit-hooks
+      - build-stable-image
+
+  - name: notify-slack-stable-failure
+    image: plugins/slack
+    settings:
+      webhook:
+        from_secret: SLACK_WEBHOOK
+      channel: *slack_channel
+      template: *failure_message
+    when:
+      - status: failure
+    depends_on:
+      - run-pre-commit-hooks
+      - build-stable-image

.yamlignore

@@ -0,0 +1,2 @@
+# Hidden
+.github

.yamllint

@@ -0,0 +1,33 @@
+---
+yaml-files:
+  - "*.yaml"
+  - "*.yml"
+  - ".yamllint"
+
+ignore-from-file: [.gitignore, .yamlignore]
+
+rules:
+  anchors: enable
+  braces: enable
+  brackets: enable
+  colons: enable
+  commas: enable
+  comments: disable
+  comments-indentation: disable
+  document-end: disable
+  document-start: disable
+  empty-lines: enable
+  empty-values: disable
+  float-values: disable
+  hyphens: enable
+  indentation: enable
+  key-duplicates: enable
+  key-ordering: disable
+  line-length: disable
+  new-line-at-end-of-file: enable
+  new-lines: enable
+  octal-values: disable
+  quoted-strings: disable
+  trailing-spaces: enable
+  truthy:
+    level: warning

Dockerfile

@@ -1,37 +1,30 @@
-FROM node:22-alpine
-
-WORKDIR /opt/
-
-RUN apk update && apk add --no-cache \
-    build-base \
-    gcc \
-    autoconf \
-    automake \
-    zlib-dev \
-    libpng-dev \
-    nasm \
-    bash \
-    vips-dev \
-    python3 \
-    make \
-    g++
-
-ARG NODE_ENV=development
+# Creating multi-stage build for production
+FROM node:22-alpine AS build
+RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev libpng-dev vips-dev git > /dev/null 2>&1
+ARG NODE_ENV=production USER=1001
 ENV NODE_ENV=${NODE_ENV}
 
+WORKDIR /opt/
 COPY package.json yarn.lock ./
-
 RUN yarn global add node-gyp
-RUN yarn config set network-timeout 600000 -g && yarn install
+RUN yarn config set network-timeout 600000 -g && yarn install --production
 ENV PATH=/opt/node_modules/.bin:$PATH
-
 WORKDIR /opt/app
 COPY . .
+RUN yarn build
 
-RUN chown -R node:node /opt/app
-USER node
+# Creating final production image
+FROM node:22-alpine
+RUN apk add --no-cache vips-dev
+ARG NODE_ENV=production USER=1001
+ENV NODE_ENV=${NODE_ENV}
+WORKDIR /opt/
+COPY --from=build --chown=${USER}:${USER} /opt/node_modules ./node_modules
+WORKDIR /opt/app
+COPY --from=build --chown=${USER}:${USER} /opt/app ./
+ENV PATH=/opt/node_modules/.bin:$PATH
 
-RUN ["yarn", "build"]
+RUN chown -R ${USER}:${USER} /opt/app
+USER ${USER}
 EXPOSE 1337
-
-CMD ["yarn", "develop"]
+CMD ["yarn", "start"]