docker: Coolify対応のためDockerfileビルドに移行しbind mount依存を排除

- ルートDockerfileで npm ci をビルド時に一元実行（node_modulesの競合破損を防止）
- web/api/workerをYAMLアンカーで共通ビルド構成に変更し、.:/workspace のbind mountを削除
- vinextは --hostname でバインド指定（--host は無視される）
- minio-initを削除（APIがbucketを自動作成）し、MinIOをexposeのみの内部公開に変更
- .dockerignore を追加し、.wranglerディレクトリをDockerfile内で事前作成

.dockerignore

@@ -0,0 +1,24 @@
+# dependencies
+node_modules
+
+# build outputs / caches
+.next
+dist
+coverage
+.vinext
+.wrangler
+
+# local data / misc
+.data
+.DS_Store
+
+# secrets & env files
+.env
+.env.*
+
+# logs
+npm-debug.log*
+
+# git / tooling
+.git
+.vercel

.env.example

@@ -6,6 +6,10 @@ NEXT_PUBLIC_AUTH_MODE=demo
 
 # --- Storage (MinIO via docker compose) -------------------------------------
 # Leave DATABASE_URL empty to run with an in-memory store instead of Postgres.
+# docker-compose.yml keeps MinIO internal-only (no published ports/domain) and
+# all uploads flow through the API, so the API uses the internal endpoint.
+# When running the API on the host instead of inside compose, re-add MinIO's
+# host ports (9000/9001) to docker-compose.yml first.
 DATABASE_URL=postgres://altdock:altdock@localhost:5432/altdock
 STORAGE_MODE=s3
 S3_ENDPOINT=http://localhost:9000
@@ -17,7 +21,7 @@ S3_FORCE_PATH_STYLE=true
 # MinIO root credentials, consumed by docker-compose.yml. CHANGE in production.
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=minioadmin123
-# Only needed when MinIO is behind a reverse proxy / domain (e.g. on Coolify):
+# Only needed when MinIO is exposed behind a reverse proxy / domain:
 MINIO_SERVER_URL=
 MINIO_BROWSER_REDIRECT_URL=
 

Dockerfile

@@ -0,0 +1,16 @@
+FROM node:22-bookworm
+
+WORKDIR /workspace
+
+# package-lock.json is committed, so npm ci installs the exact dependency tree.
+COPY package.json package-lock.json ./
+
+RUN npm ci --no-audit --no-fund
+
+COPY . .
+
+# vinext/wrangler writes logs and registry state under .wrangler; the directory
+# itself is git/dockerignored, so create it explicitly.
+RUN mkdir -p /workspace/.wrangler
+
+CMD ["npm", "run", "dev"]

docker-compose.yml

@@ -3,14 +3,24 @@
 # Environment Variables / secrets panel.
 #
 # Coolify notes:
-#   - All credentials are parameterized; set them in Coolify's env to avoid
+#   - web/api/worker are all built from the same root Dockerfile and run from
-#     the insecure local defaults.
+#     the image contents. There are no bind mounts, so nothing depends on
-#   - MinIO has a real healthcheck, so api/worker wait until it can serve.
+#     Coolify mounting the git repository at /workspace (relative paths are
-#   - The API also creates the S3 bucket itself on startup (ensureBucket),
+#     mounted as empty named volumes there).
-#     so the stack no longer depends on minio-init completing successfully.
+#   - node_modules is baked into the image once by `npm ci` at build time, so
-#   - If you expose MinIO through a domain, set MINIO_SERVER_URL (public S3 API
+#     the containers never race each other running npm install.
-#     origin) and MINIO_BROWSER_REDIRECT_URL (public console origin) so
+#   - MinIO is fully private: uploads always flow through the API (browser ->
-#     presigned upload URLs and console redirects work from the browser.
+#     API -> MinIO) and the API creates its bucket on startup, so no
+#     minio-init container and no published MinIO ports/domain are required.
+#   - postgres published port exists only for local development; on Coolify,
+#     public traffic goes through its reverse proxy and MinIO stays internal.
+
+x-altdock-app: &altdock-app
+  build:
+    context: .
+    dockerfile: Dockerfile
+  working_dir: /workspace
+  restart: unless-stopped
 
 services:
   postgres:
@@ -35,12 +45,11 @@ services:
     environment:
       MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
       MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin123}
-      # Public origins, only needed when MinIO is behind a reverse proxy/domain.
+    # Internal-only: the API reaches MinIO over the compose network and uploads
-      MINIO_SERVER_URL: ${MINIO_SERVER_URL:-}
+    # are proxied through the API, so no host ports / public domain are needed.
-      MINIO_BROWSER_REDIRECT_URL: ${MINIO_BROWSER_REDIRECT_URL:-}
+    expose:
-    ports:
+      - "9000"
-      - "9000:9000"
+      - "9001"
-      - "9001:9001"
     volumes:
       - minio-data:/data
     healthcheck:
@@ -50,35 +59,16 @@ services:
       retries: 12
       start_period: 10s
 
-  # Optional belt-and-suspenders: pre-creates the bucket. The API does the
-  # same on startup, so this can be removed without affecting functionality.
-  minio-init:
-    image: minio/mc:latest
-    depends_on:
-      minio:
-        condition: service_healthy
-    entrypoint: ["/bin/sh", "-c"]
-    command: >-
-      "until mc alias set local http://minio:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-minioadmin123}; do sleep 1; done;
-      mc mb --ignore-existing local/${S3_BUCKET:-altdock}"
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin123}
-
   api:
-    image: node:22-bookworm
+    <<: *altdock-app
-    working_dir: /workspace
+    command: sh -c "npm run db:migrate && exec npm run dev:api"
-    command: sh -c "npm install --no-audit --no-fund && npm run dev:api"
     environment:
-      NODE_ENV: development
       PORT: 4000
-      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:4000}
-      WEB_ORIGIN: ${WEB_ORIGIN:-http://localhost:3000}
       DATABASE_URL: postgres://${POSTGRES_USER:-altdock}:${POSTGRES_PASSWORD:-altdock}@postgres:5432/${POSTGRES_DB:-altdock}
       STORAGE_MODE: s3
-      # S3_ENDPOINT is the internal address; presigned URLs resolve via the
+      # Internal address only; uploads are proxied through the API, so MinIO
-      # public MINIO_SERVER_URL when set.
+      # never needs a public URL.
-      S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
+      S3_ENDPOINT: http://minio:9000
       S3_REGION: ${S3_REGION:-us-east-1}
       S3_BUCKET: ${S3_BUCKET:-altdock}
       S3_ACCESS_KEY_ID: ${MINIO_ROOT_USER:-minioadmin}
@@ -86,10 +76,10 @@ services:
       S3_FORCE_PATH_STYLE: "true"
       AUTH_MODE: ${AUTH_MODE:-demo}
       PROCESS_INLINE: "false"
+      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:4000}
+      WEB_ORIGIN: ${WEB_ORIGIN:-http://localhost:3000}
     ports:
       - "4000:4000"
-    volumes:
-      - .:/workspace
     depends_on:
       postgres:
         condition: service_healthy
@@ -97,14 +87,12 @@ services:
         condition: service_healthy
 
   worker:
-    image: node:22-bookworm
+    <<: *altdock-app
-    working_dir: /workspace
+    command: npm run dev:worker
-    command: sh -c "npm install --no-audit --no-fund && npm run dev:worker"
     environment:
-      NODE_ENV: development
       DATABASE_URL: postgres://${POSTGRES_USER:-altdock}:${POSTGRES_PASSWORD:-altdock}@postgres:5432/${POSTGRES_DB:-altdock}
       STORAGE_MODE: s3
-      S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
+      S3_ENDPOINT: http://minio:9000
       S3_REGION: ${S3_REGION:-us-east-1}
       S3_BUCKET: ${S3_BUCKET:-altdock}
       S3_ACCESS_KEY_ID: ${MINIO_ROOT_USER:-minioadmin}
@@ -112,8 +100,6 @@ services:
       S3_FORCE_PATH_STYLE: "true"
       AUTH_MODE: ${AUTH_MODE:-demo}
       PROCESS_INLINE: "false"
-    volumes:
-      - .:/workspace
     depends_on:
       postgres:
         condition: service_healthy
@@ -121,15 +107,15 @@ services:
         condition: service_healthy
 
   web:
-    image: node:22-bookworm
+    <<: *altdock-app
-    working_dir: /workspace
+    # vinext uses --hostname (not vite's --host) to bind the dev server.
-    command: sh -c "npm install --no-audit --no-fund && npm run dev -- --host 0.0.0.0"
+    command: npm run dev -- --hostname 0.0.0.0
     environment:
+      HOST: 0.0.0.0
       NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:4000}
+      NEXT_PUBLIC_AUTH_MODE: ${AUTH_MODE:-demo}
     ports:
       - "3000:3000"
-    volumes:
-      - .:/workspace
     depends_on:
       api:
         condition: service_started