Pr 1532

.dockerignore

@@ -0,0 +1,13 @@
+node_modules
+.git
+dist
+.cache
+.nx
+.vp
+.env*
+!.env.schema
+!**/.env.schema
+data
+*.sqlite*
+*.db*
+apps/*/dist

.env.schema

@@ -0,0 +1,28 @@
+# Shared config for the monorepo. Each app's own .env.schema imports this file
+# with an explicit pick list. Local overrides go in gitignored .env / .env.local;
+# encrypt sensitive .env.local values with `pnpm exec varlock encrypt --file .env.local`.
+# @defaultSensitive=false
+# @defaultRequired=infer
+# ---
+# SQLite database path. Supplied at boot in Docker (/data/sqlite.db).
+# @type=string @sensitive=false @dynamic=boot
+DATABASE_URL=./sqlite.db
+# Public URL of the Elysia server (better-auth base URL).
+# @type=url @sensitive=false
+BETTER_AUTH_URL=http://localhost:3000
+# Port the Elysia server listens on.
+# @type=number @sensitive=false
+PORT=3000
+# Base URL the web app (port 3001) uses to reach the API server for Eden Treaty
+# and the better-auth client.
+# @type=url @sensitive=false
+VITE_API_URL=http://localhost:3000
+# better-auth secret. Dev placeholder — override with a real value in .env.local.
+# @type=string @sensitive
+AUTH_SECRET=local-dev-placeholder-not-for-prod
+# Discord OAuth client id (public identifier); empty until Discord login is configured.
+# @type=string @sensitive=false
+AUTH_DISCORD_ID=''
+# Discord OAuth client secret; set in .env.local (encrypted) to enable Discord login.
+# @type=string @sensitive @optional
+AUTH_DISCORD_SECRET=

.github/workflows/ci.yml

@@ -11,25 +11,28 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
-# You can leverage Vercel Remote Caching with Turbo to speed up your builds
-# @link https://turborepo.com/docs/core-concepts/remote-caching#remote-caching-on-vercel-builds
 env:
   FORCE_COLOR: 3
-  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
 
 jobs:
-  lint:
+  env:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
 
       - name: Setup
         uses: ./tooling/github/setup
 
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
+      - name: Validate env schemas
+        run: pnpm env:validate
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Setup
+        uses: ./tooling/github/setup
 
       - name: Lint
         run: pnpm lint && pnpm lint:ws
@@ -55,3 +58,14 @@ jobs:
 
       - name: Typecheck
         run: pnpm typecheck
+
+  check-web:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Check web
+        run: pnpm nx run @acme/web:check

.gitignore

@@ -40,6 +40,7 @@ yarn-error.log*
 # local env files
 .env
 .env*.local
+.varlock-frozen-env
 
 # vercel
 .vercel
@@ -48,8 +49,25 @@ yarn-error.log*
 dist/
 .cache
 
-# turbo
-.turbo
-
 # tanstack
-.tanstack
+.tanstack
+
+# nx
+.nx
+
+# vite-plus
+.vp
+
+# mikro-orm schema snapshots (regenerated from the live schema)
+.snapshot-*.json
+
+# sqlite
+data/
+*.sqlite
+*.sqlite-journal
+*.sqlite-wal
+*.sqlite-shm
+*.db
+*.db-journal
+*.db-wal
+*.db-shm

.vscode/launch.json

@@ -2,16 +2,11 @@
   "version": "0.2.0",
   "configurations": [
     {
-      "name": "Next.js",
+      "name": "Nx dev",
       "type": "node-terminal",
       "request": "launch",
       "command": "pnpm dev",
-      "cwd": "${workspaceFolder}/apps/nextjs",
-      "skipFiles": ["<node_internals>/**"],
-      "sourceMaps": true,
-      "sourceMapPathOverrides": {
-        "/turbopack/[project]/*": "${webRoot}/*" //https://github.com/vercel/next.js/issues/62008
-      }
+      "cwd": "${workspaceFolder}"
     }
   ]
 }

Dockerfile.server

@@ -0,0 +1,20 @@
+FROM node:22 AS deps
+RUN corepack enable
+WORKDIR /app
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml nx.json ./
+COPY apps apps
+COPY packages packages
+COPY tooling tooling
+RUN pnpm install --frozen-lockfile
+
+FROM oven/bun:1 AS run
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app ./
+COPY .varlock-frozen-env ./
+ENV _VARLOCK_USE_FROZEN_ENV=1
+# DATABASE_URL is @dynamic=boot: this overrides the frozen ./sqlite.db default for
+# both the migration CMD (raw process.env read) and the server boot (varlock).
+ENV DATABASE_URL=/data/sqlite.db
+EXPOSE 3000
+CMD ["sh", "-c", "cd packages/db && bunx --bun mikro-orm migration:up && cd /app && exec bun apps/server/src/index.ts"]

Dockerfile.web

@@ -0,0 +1,13 @@
+FROM node:22 AS build
+RUN corepack enable
+WORKDIR /app
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml nx.json ./
+COPY .env.schema ./
+COPY apps apps
+COPY packages packages
+COPY tooling tooling
+RUN pnpm install --frozen-lockfile
+RUN pnpm nx run @acme/web:build
+
+FROM nginx:alpine AS run
+COPY --from=build /app/apps/web/dist/client /usr/share/nginx/html