Dockerfile

# Atlas runs as one long-lived process: the HTTP server plus the background
# job worker, on top of either the embedded database (a mounted volume) or a
# hosted PostgreSQL (DATABASE_URL). This image works unchanged on Fly.io,
# Render, Railway, or any container host.
#
#   docker build -t notion-atlas .
#   docker run -p 8792:8792 -v atlas-data:/data notion-atlas

# ── build ────────────────────────────────────────────────────────────────
FROM node:22-slim AS build
WORKDIR /app

# Manifests first, so this layer caches until a dependency actually changes.
COPY package.json package-lock.json ./
COPY packages/shared/package.json packages/shared/
COPY packages/db/package.json packages/db/
COPY packages/graph/package.json packages/graph/
COPY packages/ranking/package.json packages/ranking/
COPY packages/search/package.json packages/search/
COPY packages/notion/package.json packages/notion/
COPY workers/package.json workers/
COPY apps/api/package.json apps/api/
COPY apps/web/package.json apps/web/
COPY apps/extension/package.json apps/extension/
RUN npm ci --no-audit --no-fund

COPY . .
# turbo build → apps/web/dist (static site) + apps/api/dist/server.mjs
RUN npm run build

# Drop devDependencies. The API bundle deliberately keeps real dependencies
# external (PGlite ships WASM assets that must not be inlined), so runtime
# node_modules still has to exist.
RUN npm prune --omit=dev --ignore-scripts

# ── runtime ──────────────────────────────────────────────────────────────
FROM node:22-slim AS runtime
WORKDIR /app
ENV NODE_ENV=production \
    # containers must bind all interfaces, not loopback
    HOST=0.0.0.0 \
    PORT=8792 \
    # embedded database lives on the mounted volume; ignored when
    # DATABASE_URL points at a hosted PostgreSQL instead
    ATLAS_DATA_DIR=/data/pglite

COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/package.json ./package.json
# server.mjs resolves the web build at ../../web/dist, so this layout matters
COPY --from=build /app/apps/api/dist ./apps/api/dist
COPY --from=build /app/apps/web/dist ./apps/web/dist

RUN mkdir -p /data
# Runs as root on purpose: Fly and Render mount persistent volumes owned by
# root, so a non-root process cannot write its database on first boot. To
# harden this, chown the mount in an entrypoint and drop privileges there.
VOLUME ["/data"]
EXPOSE 8792

HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8792)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

CMD ["node", "apps/api/dist/server.mjs"]