twotalesanimation
ec125261e4
Deploy Vault CMS / deploy (push) Successful in 1m15s
- Build Next.js as a standalone server and copy only that into the runtime image, instead of the whole node_modules tree - Mark three dynamic file reads with turbopackIgnore so the standalone trace does not pull in the entire project - Deploy workflow prunes unused images and build cache older than a day at the start and end of every run, including failed ones, and logs disk usage before building Failed builds were leaving their layers behind until the server's disk filled, which broke the deploy, the database and Gitea sign-in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1.1 KiB
TypeScript
36 lines
1.1 KiB
TypeScript
import type { NextConfig } from "next";
|
|
|
|
const securityHeaders = [
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
|
|
// Limited to directives that don't conflict with Next.js inline scripts:
|
|
// blocks <base> tag hijacking, plugin content, and framing (clickjacking)
|
|
{
|
|
key: "Content-Security-Policy",
|
|
value: "base-uri 'self'; object-src 'none'; frame-ancestors 'none'",
|
|
},
|
|
];
|
|
|
|
const nextConfig: NextConfig = {
|
|
poweredByHeader: false,
|
|
// Emit a self-contained server with only the files it needs, so the Docker
|
|
// image does not have to ship the whole node_modules tree.
|
|
output: "standalone",
|
|
images: {
|
|
remotePatterns: [
|
|
{
|
|
protocol: "https",
|
|
hostname: "lh3.googleusercontent.com",
|
|
pathname: "/**",
|
|
},
|
|
],
|
|
},
|
|
async headers() {
|
|
return [{ source: "/:path*", headers: securityHeaders }];
|
|
},
|
|
};
|
|
|
|
export default nextConfig;
|