From 9c96e742fa8e85625da1db471d4cf1aa73f5da01 Mon Sep 17 00:00:00 2001
From: an14051 <anders.boettcher@studmail.w-hs.de>
Date: Wed, 13 May 2026 00:30:19 +0200
Subject: [PATCH] feat: enhance Dockerfile with health check and secure
 permissions; update next.config.ts formatting

---
 docker/Dockerfile       | 32 +++++++++++++++++++++++++-------
 frontend/next.config.ts |  3 +--
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 978f85c..237ead1 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -24,21 +24,39 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 
-# Dedicated non-root user
-RUN apt-get update && apt-get install -y --no-install-recommends adduser && rm -rf /var/lib/apt/lists/* && \
-    addgroup --system --gid 1001 nodejs && \
-    adduser  --system --uid 1001 nextjs
+# Suppress debconf warnings in Docker
+ENV DEBIAN_FRONTEND=noninteractive
 
-# Next.js standalone output
+# Dedicated non-root user
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends adduser && \
+    rm -rf /var/lib/apt/lists/* && \
+    addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+# Create writable data directory with proper permissions
+RUN mkdir -p /app/data/uploads && \
+    chown -R nextjs:nodejs /app/data && \
+    chmod 750 /app/data && \
+    chmod 700 /app/data/uploads
+
+# Copy only production artifacts from builder (no source code, no node_modules)
 COPY --from=builder /app/public           ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static     ./.next/static
 
-# Writable data directory for file uploads
-RUN mkdir -p /app/data/uploads && chown -R nextjs:nodejs /app/data
+# Secure filesystem permissions
+RUN chmod 755 /app && \
+    chmod 755 /app/.next && \
+    chmod 755 /app/public
 
+# Switch to non-root user
 USER nextjs
 
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+  CMD bun --eval "import('http').then(h => h.request('http://localhost:3000/', res => process.exit(res.statusCode === 200 ? 0 : 1)).end())" || exit 1
+
 EXPOSE 3000
 
 ENV PORT=3000
diff --git a/frontend/next.config.ts b/frontend/next.config.ts
index f54e9ef..f7d8792 100644
--- a/frontend/next.config.ts
+++ b/frontend/next.config.ts
@@ -14,8 +14,7 @@ const securityHeaders = [
 
 const nextConfig: NextConfig = {
   output: "standalone",
-  serverExternalPackages: ["@libsql/client"],
-  experimental: {
+  serverExternalPackages: ["@libsql/client"],  productionBrowserSourceMaps: false,  experimental: {
     serverActions: {
       bodySizeLimit: "500mb",
     },