fix: deploy on Dokploy from .env settings with one lean image

[voidash]

What changed

Makes the Docker deployment work from the settings a hosting platform provides, and ships one 286 MB image instead of a 341 MB app image plus a 2.07 GB migration image.

• Settings from .env. Compose required apps/api/.env.local and passed nothing else into the containers. A deployment that supplies settings the usual way, in a .env next to docker-compose.yml, could not start: Compose refused to run without the file, and once it existed the app received only DATABASE_URL and STORAGE_DIR, so it stopped with "Invalid environment configuration". Compose now reads every setting from one file, the .env next to docker-compose.yml: both its own settings and the ones it passes to the app and migrate. apps/api/.env.local is only for bun run dev. The Compose-only settings (POSTGRES_*, DB_PORT, API_PORT) are listed in a section of apps/api/.env.example, which Docker users copy to .env.

• Production stack for Dokploy. prod-docker-compose.yaml runs the one-shot migration and the app against the project's Dokploy-managed Postgres (DATABASE_URL = its Internal Connection URL, reached over dokploy-network), so the database gets Dokploy's database backups. Settings load from the .env Dokploy writes; the app only exposes 3000; avatars are in a named volume; no container_name. Compose refuses to deploy without DATABASE_URL or AUTH_URL. docs/deployment.md has step-by-step Dokploy instructions.

• Database credentials from .env. POSTGRES_USER, POSTGRES_PASSWORD and POSTGRES_DB can be set there (defaults unchanged), and DATABASE_URL is built from them.

• No separate migration image. The migration, project-init and GitHub-sync scripts are bundled with bun build into three single files (1.1 MB in total) that plain Node runs from the app image. The migrate service in Compose uses the same image with node scripts/migrate.js, and reads the env file so one-off tasks get GITHUB_TOKEN.

• One migrator everywhere. db:migrate uses Drizzle's built-in migrator, the one the tests already used, instead of drizzle-kit migrate. Both record applied migrations in the same table, so existing databases carry on as they are.

• No unused image optimiser. sharp and libvips (about 19 MB) are left out of the standalone output; no page uses next/image, and images.unoptimized is set.

• No package managers (npm, yarn, corepack) in the runtime image.

• Base images pinned by digest.

• Configurable ports. DB_PORT and API_PORT override the host ports in compose.yaml (defaults unchanged: 5432, 3000), so the stack can run beside another Postgres or app. This was chore: make compose ports configurable #38, folded in here.

Closes #52

Contract impact

• No changes to packages/api-contract

Checks

• bun run lint
• bun run typecheck
• bun run test (150 passed)
• bun run build
• CI's migration step (bun run db:migrate on a clean database) with the new script

Tested with Docker from a clone of this branch:

Check	Result
Image	286 MB (was 341 MB + 2.07 GB); no npm/yarn/corepack, no sharp; runs as node
docker compose up on a fresh database	migrations applied, app healthy in 27 s
node scripts/init-project.js, node scripts/sync-github.js in the image	project initialised, issues synced
Pages and API (/en, /ne, members, issues, project, /v1/*, /health)	200; HTML byte-for-byte the same size as from the old image
Browser: static assets	all 10 same-origin images, fonts and stylesheets load
DB_PORT=15432 API_PORT=13000 docker compose up -d beside a stack holding 5432 and 3000	runs; defaults unchanged
Platform style: only a root .env (custom POSTGRES_PASSWORD, AUTH_URL), no .env.local	settings reach the app, migrations run, app healthy, callback is https://devnepal.gov.np/..., pages 200
prod-docker-compose.yaml without DATABASE_URL or AUTH_URL	refuses to deploy, naming the missing setting
prod-docker-compose.yaml against a stand-in for the Dokploy Postgres service on dokploy-network	migrations applied to it, app healthy, callback https://devnepal.gov.np/..., pages 200, node scripts/init-project.js works, no host ports
Only apps/api/.env.local	Compose ignores it and uses the defaults; docker compose up -d db (used by bun run setup) still starts
Both files	only .env is used, for the containers and for POSTGRES_*/ports alike
drizzle-kit migrate then this image's migration on the same database	nothing applied twice (3 migration rows)
New migrator then drizzle-kit migrate, and the reverse, on fresh databases	identical migration history and tables

Notes for reviewers

outputFileTracingExcludes names Bun's node_modules/.bun/ layout explicitly, because globs do not match that hidden directory. If the package manager changes, those two paths need updating; the build would then include sharp again, not break.

Foundation checklist

• Commits signed off (git commit -s)
• Works in both English and Nepali where applicable (no text changes)
• No secrets or real personal data anywhere in the diff
• Documentation updated (docs/deployment.md, .env.example)

[abhiyandhakal]

@voidash seems like there is a merge conflict.