feat: enhance Dockerfile with health check and secure permissions; update next.config.ts formatting

docker/Dockerfile

@@ -24,21 +24,39 @@ WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 
-# Dedicated non-root user
+# Suppress debconf warnings in Docker
-RUN apt-get update && apt-get install -y --no-install-recommends adduser && rm -rf /var/lib/apt/lists/* && \
+ENV DEBIAN_FRONTEND=noninteractive
-    addgroup --system --gid 1001 nodejs && \
-    adduser  --system --uid 1001 nextjs
 
-# Next.js standalone output
+# Dedicated non-root user
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends adduser && \
+    rm -rf /var/lib/apt/lists/* && \
+    addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+# Create writable data directory with proper permissions
+RUN mkdir -p /app/data/uploads && \
+    chown -R nextjs:nodejs /app/data && \
+    chmod 750 /app/data && \
+    chmod 700 /app/data/uploads
+
+# Copy only production artifacts from builder (no source code, no node_modules)
 COPY --from=builder /app/public           ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static     ./.next/static
 
-# Writable data directory for file uploads
+# Secure filesystem permissions
-RUN mkdir -p /app/data/uploads && chown -R nextjs:nodejs /app/data
+RUN chmod 755 /app && \
+    chmod 755 /app/.next && \
+    chmod 755 /app/public
 
+# Switch to non-root user
 USER nextjs
 
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+  CMD bun --eval "import('http').then(h => h.request('http://localhost:3000/', res => process.exit(res.statusCode === 200 ? 0 : 1)).end())" || exit 1
+
 EXPOSE 3000
 
 ENV PORT=3000

frontend/next.config.ts

@@ -14,8 +14,7 @@ const securityHeaders = [
 
 const nextConfig: NextConfig = {
   output: "standalone",
-  serverExternalPackages: ["@libsql/client"],
+  serverExternalPackages: ["@libsql/client"],  productionBrowserSourceMaps: false,  experimental: {
-  experimental: {
     serverActions: {
       bodySizeLimit: "500mb",
     },