2026-07-17 13:04:18 -04:00
|
|
|
# Keep the build context small and NEVER bake secrets or host-built artifacts into the image.
|
|
|
|
|
|
|
|
|
|
# Secrets — must never enter the image (env is injected by Dokploy at runtime).
|
|
|
|
|
.env
|
|
|
|
|
.env.*
|
|
|
|
|
!.env.example
|
|
|
|
|
|
|
|
|
|
# Dependencies + build outputs (reinstalled / rebuilt inside the image).
|
|
|
|
|
node_modules
|
|
|
|
|
**/node_modules
|
|
|
|
|
apps/web/dist
|
|
|
|
|
apps/api/dist
|
|
|
|
|
dist
|
|
|
|
|
build
|
|
|
|
|
.turbo
|
|
|
|
|
.cache
|
|
|
|
|
coverage
|
|
|
|
|
|
|
|
|
|
# VCS / CI / editor / OS noise.
|
|
|
|
|
.git
|
|
|
|
|
.gitignore
|
|
|
|
|
.github
|
|
|
|
|
.vscode
|
|
|
|
|
.idea
|
|
|
|
|
.DS_Store
|
|
|
|
|
Thumbs.db
|
|
|
|
|
|
|
|
|
|
# Logs and legacy Plesk/Passenger runtime scratch.
|
|
|
|
|
*.log
|
|
|
|
|
logs
|
|
|
|
|
tmp
|
|
|
|
|
|
|
|
|
|
# Local-only storage dirs (documents live in Spaces).
|
|
|
|
|
storage
|
|
|
|
|
uploads
|
|
|
|
|
|
2026-07-17 13:34:33 -04:00
|
|
|
# Tests and test tooling aren't needed in the runtime image.
|
2026-07-17 13:04:18 -04:00
|
|
|
apps/api/test
|
|
|
|
|
**/*.test.ts
|
2026-07-17 13:34:33 -04:00
|
|
|
**/*.spec.ts
|
|
|
|
|
**/vitest.config.ts
|
|
|
|
|
**/vitest.*.config.ts
|
|
|
|
|
|
|
|
|
|
# Destructive/privileged one-off scripts must NOT ship in the runtime image: an attacker with
|
|
|
|
|
# code-exec in the container has DATABASE_URL in-env, so keeping these off disk removes the sharpest
|
|
|
|
|
# RCE-amplification tools. Root-anchored to the top-level scripts/ only (apps/web/scripts, used by the
|
|
|
|
|
# web build, is a different directory and is kept). DB migrations run via `npm run db:migrate`
|
|
|
|
|
# (packages/db), not from scripts/, so this does not affect builds or deploys.
|
|
|
|
|
#
|
|
|
|
|
# The routine, non-destructive cron scripts (retention-sweep, send-overdue-reminders,
|
|
|
|
|
# sweep-orphaned-storage) are intentionally KEPT so Dokploy scheduled jobs can invoke them inside
|
|
|
|
|
# the container (e.g. `npm run cron:retention`, which enforces Privacy-Policy retention windows).
|
|
|
|
|
/scripts/seed-demo.ts
|
|
|
|
|
/scripts/create-admin.ts
|
|
|
|
|
/scripts/migrate-storage-to-spaces.ts
|
|
|
|
|
/scripts/plesk-deploy.sh
|
2026-07-17 13:04:18 -04:00
|
|
|
|
|
|
|
|
# Note: certs/ is intentionally NOT ignored — the Postgres CA cert (if committed) is baked in
|
|
|
|
|
# so production TLS verification works. See DEPLOY-DOKPLOY.md.
|
