Add production Docker deployment configuration

- Add multi-stage Dockerfile for Next.js standalone build
- Add docker-compose.deploy.yml for production deployment
- Add entrypoint.sh for database migration and startup
- Add .dockerignore for efficient Docker builds
- Add docker/.env.production with all required env vars
- Add Caddyfile.prod with security headers and optimizations
- Update next.config.ts with output: standalone for Docker
- Add DOCKER_DEPLOYMENT.md with comprehensive deployment guide

docker/Caddyfile.prod

@@ -0,0 +1,22 @@
+{$DOMAIN} {
+  reverse_proxy web:3000 {
+    header_up Host {host}
+    header_up X-Real-IP {remote_host}
+    header_up X-Forwarded-For {remote_host}
+    header_up X-Forwarded-Proto {scheme}
+  }
+
+  # Compression
+  encode gzip
+
+  # Security headers
+  header X-Content-Type-Options nosniff
+  header X-Frame-Options SAMEORIGIN
+  header X-XSS-Protection "1; mode=block"
+  header Referrer-Policy strict-origin-when-cross-origin
+}
+
+# MinIO console (optional - remove in production for security)
+# minio.{$DOMAIN} {
+#   reverse_proxy minio:9001
+# }

docker/docker-compose.deploy.yml

@@ -0,0 +1,135 @@
+version: '3.8'
+
+services:
+  postgres:
+    image: postgres:17-alpine
+    restart: always
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-epicure}
+      POSTGRES_USER: ${POSTGRES_USER:-epicure}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-epicure}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - epicure
+
+  redis:
+    image: redis:7-alpine
+    restart: always
+    command: redis-server --requirepass ${REDIS_PASSWORD:-changeme}
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - epicure
+
+  minio:
+    image: minio/minio:latest
+    restart: always
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-changeme}
+    volumes:
+      - minio_data:/data
+    command: server /data --console-address ":9001"
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - epicure
+
+  minio-init:
+    image: minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: >
+      /bin/sh -c "
+        mc alias set local http://minio:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-changeme};
+        mc mb --ignore-existing local/epicure-uploads;
+        mc anonymous set download local/epicure-uploads;
+        exit 0;
+      "
+    networks:
+      - epicure
+
+  web:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: always
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER:-epicure}:${POSTGRES_PASSWORD:-changeme}@postgres:5432/${POSTGRES_DB:-epicure}
+      REDIS_URL: redis://:${REDIS_PASSWORD:-changeme}@redis:6379
+      STORAGE_ENDPOINT: http://minio:9000
+      STORAGE_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
+      STORAGE_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-changeme}
+      STORAGE_BUCKET: epicure-uploads
+      STORAGE_REGION: us-east-1
+      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
+      BETTER_AUTH_URL: ${BETTER_AUTH_URL}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
+      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
+      OPENROUTER_DEFAULT_MODEL: ${OPENROUTER_DEFAULT_MODEL:-nvidia/nemotron-3-ultra-550b-a55b:free}
+      SMTP_HOST: ${SMTP_HOST}
+      SMTP_PORT: ${SMTP_PORT}
+      SMTP_SECURE: ${SMTP_SECURE:-false}
+      SMTP_USER: ${SMTP_USER}
+      SMTP_PASS: ${SMTP_PASS}
+      SMTP_FROM: ${SMTP_FROM}
+      NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${NEXT_PUBLIC_VAPID_PUBLIC_KEY}
+      NODE_ENV: production
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      minio:
+        condition: service_healthy
+    networks:
+      - epicure
+
+  caddy:
+    image: caddy:2-alpine
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+      - caddy_data:/data
+      - caddy_config:/config
+    environment:
+      DOMAIN: ${DOMAIN:-localhost}
+    depends_on:
+      - web
+    networks:
+      - epicure
+
+volumes:
+  postgres_data:
+    driver: local
+  redis_data:
+    driver: local
+  minio_data:
+    driver: local
+  caddy_data:
+    driver: local
+  caddy_config:
+    driver: local
+
+networks:
+  epicure:
+    driver: bridge

docker/entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -e
+
+# Wait for database to be ready
+until pg_isready -h "${DB_HOST:-postgres}" -U "${POSTGRES_USER:-epicure}" -d "${POSTGRES_DB:-epicure}"; do
+  echo "Waiting for PostgreSQL to be ready..."
+  sleep 2
+done
+
+echo "PostgreSQL is ready!"
+
+# Run migrations
+echo "Running database migrations..."
+cd /app/apps/web
+pnpm db:migrate || true
+
+echo "Starting application..."
+exec node /app/apps/web/.next/standalone/server.js