Oday BakkourandClaude Fable 5.1
f0dc5a16fc
Adds a second runtime next to Cloudflare Workers. One Node process serves the Next app, a realtime WebSocket hub, the job queues, the backup schedule and an SMTP listener; SQLite and local files replace D1 and R2. The application code is unchanged: the runtime builds an object with the same binding interfaces (`server/runtime/`) and publishes it before Next starts, so `getEnv()` hands route handlers the same shape on both platforms. Runtime (server/) - `sqlite-database.ts`: the D1 API over better-sqlite3, so Drizzle's D1 driver, the raw `env.DB.prepare` callers, the FTS5 index and its triggers all work as-is. Migrations are applied from drizzle/migrations at start, recorded in `d1_migrations` like Wrangler does. - `file-bucket.ts`: the R2 API over a directory, with metadata sidecars and byte ranges. `mailer.ts`: the send_email builder over nodemailer (any SMTP relay) or Cloudflare's Email Sending REST API; generates the Message-ID so threading matches Workers. `queue.ts`: in-process queues with the same retry policy. `realtime.ts`: per-user WebSocket fan-out in place of the Durable Object. `misc.ts`: rate limiter and ASSETS fetcher. - `smtp.ts`: inbound SMTP on port 25 via smtp-server; reject rules answer 550, forward rules relay the raw message through the outbound SMTP. - `index.ts`: the custom server; `scripts/build-server.mjs` bundles it with esbuild to dist/server.mjs. Application changes - `src/lib/runtime.ts` + `getEnv()` prefer the Node env when present. - `src/lib/email/intake.ts` factors the Worker email handler's logic so the SMTP listener and the new signed `/api/inbound` webhook share it. - Domains without Cloudflare credentials are recorded with zone id "manual": Cloudflare calls no-op, the domain is active at once, and the DNS page lists MX/SPF/DMARC records to create. Setup checks, the domains page copy and the self-update button adapt to the runtime; `/api/auth/me` exposes `runtime` and `managesDns`. - `APP_URL` overrides the origin for reset links and the JMAP session behind a proxy. The direct `getCloudflareContext` import in the update route is replaced with `getEnv()`. Deployment - Dockerfile (multi-stage, 1.1 GB, Workers toolchain pruned), compose file, `.env.docker.example`, `docs/self-hosting.md`, README section. - `deploy/cloudflare-email-relay`: a Worker that keeps MX on Cloudflare Email Routing and posts messages to the server with an HMAC signature, acting on the reject/forward decision it returns. Verified on a fresh data directory and again inside the built image: migrations apply, first-run setup and registration work with no Cloudflare credentials, mail over SMTP lands in the inbox with the raw copy on disk, a reject rule answers 550, a send through SMTP_URL loops back and is stored as sent and received, an inbound reply threads with the sent copy, FTS search finds body text, a backup completes to the volume, the WebSocket delivers a push, the relay webhook rejects a bad signature and returns store/reject decisions, JMAP serves a session with the APP_URL origin. Container healthcheck reports healthy. tsc (11) and eslint (105) unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PGeWDVSkXtVEmDAN2AtB9h
41 lines
2.0 KiB
Docker
41 lines
2.0 KiB
Docker
# Mailflare self-hosted image: Next.js app, SMTP listener, job queues and
|
|
# backups in one Node process. Data lives in /data (mount a volume).
|
|
FROM node:22-bookworm-slim AS base
|
|
WORKDIR /app
|
|
ENV NEXT_TELEMETRY_DISABLED=1 MAILFLARE_RUNTIME=node
|
|
|
|
# better-sqlite3 ships prebuilt binaries for this image; the toolchain is only
|
|
# a fallback for platforms without one.
|
|
FROM base AS deps
|
|
RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ && rm -rf /var/lib/apt/lists/*
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --ignore-scripts && npm rebuild better-sqlite3
|
|
|
|
FROM deps AS build
|
|
COPY . .
|
|
ARG NEXT_PUBLIC_TURNSTILE_SITE_KEY
|
|
ENV NEXT_PUBLIC_TURNSTILE_SITE_KEY=$NEXT_PUBLIC_TURNSTILE_SITE_KEY
|
|
RUN npm run build:node && rm -rf .next/cache
|
|
|
|
# Production dependencies only. The Workers toolchain arrives as transitive
|
|
# dependencies of the Cloudflare adapter and is never loaded here, so it goes.
|
|
FROM deps AS prod-deps
|
|
RUN npm prune --omit=dev --ignore-scripts \
|
|
&& rm -rf node_modules/wrangler node_modules/miniflare node_modules/workerd node_modules/@cloudflare node_modules/cloudflare node_modules/@aws-sdk node_modules/esbuild node_modules/@esbuild node_modules/typescript
|
|
|
|
FROM base AS runtime
|
|
ENV NODE_ENV=production DATA_DIR=/data PORT=3000 SMTP_INBOUND_PORT=25
|
|
COPY --chown=node:node --from=prod-deps /app/node_modules ./node_modules
|
|
COPY --chown=node:node --from=build /app/.next ./.next
|
|
COPY --chown=node:node --from=build /app/dist ./dist
|
|
COPY --chown=node:node --from=build /app/public ./public
|
|
COPY --chown=node:node --from=build /app/drizzle ./drizzle
|
|
COPY --chown=node:node --from=build /app/package.json /app/next.config.ts ./
|
|
COPY --chown=node:node --from=build /app/src/lib/security/headers.ts ./src/lib/security/headers.ts
|
|
RUN mkdir -p /data && chown node:node /data
|
|
USER node
|
|
VOLUME ["/data"]
|
|
EXPOSE 3000 25
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/api/setup/status').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
CMD ["node", "dist/server.mjs"]
|