feat(delivery): phase 12 — the container, and the defect only a proxy could find

PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the
count to fifty-seven; recorded in §6, "How phase 12 delivered it".

A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts,
.env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the
community-health files this was the only repository of the ten to lack, and
DEPLOY.md.

D54 — a merge deploys, amending D6. build-image.yml pushes
runicgateway-site:latest and :sha-<7>, then rolls the container over on the
`rgcom` runner out of /opt/runicgateway.com, and waits for the container's own
healthcheck rather than for `up -d` to return.

D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md
states the four requirements rather than one worked example, and the container
binds 127.0.0.1 so the safe configuration is the default.

D56 — @astrojs/node derives the request protocol from req.socket.encrypted and
never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends
Origin: https://… while the container computes http://… and Astro's CSRF check
compares them for equality. Every beta signup, from every visitor, was answered
403. serve.mjs now normalises both forwarded headers, unconditionally — the image
should deploy and work. Two assertions in test/headers.test.mjs hold both halves.

D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md
are pointers to the org's copies rather than copies, because a copy would hard-code
the contact address D13 confines to brand.json.

Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests,
astro check 0 errors). The image was built and run with both mounts — a mounted
brand reached 51 files and all 50 search pages, /brand/* fell back per file, a
proxy-shaped signup reached the store, and the export CLI wrote both Play files to
the host mount. docker compose config caught a YAML trap in the healthcheck: a
block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping.

Co-Authored-By: Claude <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,102 @@
+# runicgateway.com — the one container (PLAN.md §6).
+#
+# Two stages. The first has the whole toolchain and produces `dist/`; the second
+# carries the built site, the pruned runtime dependencies and nothing else.
+#
+# Debian slim rather than Alpine, deliberately. Two of the runtime dependencies
+# are native — `better-sqlite3` (the beta store, §8) and `sharp` (the brand
+# derivations, §7) — and both publish prebuilt binaries for glibc. On musl they
+# are compiled from source instead, which means a C++ toolchain, libvips headers
+# and several minutes in the image build, to save about sixty megabytes on a
+# thing that is pulled a few times a year. A third, `pagefind`, ships a platform
+# binary and is needed at RUN time, not just build time: the boot rewrite
+# re-indexes the site after the brand strings change.
+
+# ---------------------------------------------------------------------------------------
+# Stage 1 — build
+# ---------------------------------------------------------------------------------------
+FROM node:22-bookworm-slim AS build
+
+WORKDIR /build
+
+# Dependencies first, so an edit to a page does not re-resolve the tree.
+COPY package.json package-lock.json ./
+RUN npm ci
+
+# Then the source. .dockerignore keeps node_modules, dist and BOTH bind mounts out.
+COPY . .
+
+# Prerenders every marketing, legal and documentation page, builds the Node
+# server entry for the two routes that run per request, and writes the per-route
+# Content-Security-Policy into dist/_headers.json (D48).
+#
+# No token and no network: everything the build reads is in this context. The
+# checks that DO need the Gitea API — facts, quickstart, reference — run in CI
+# against the pull request, which is the right place for them. An image build
+# that could fail because another repository's server was slow would be an image
+# build people learn to retry rather than read.
+RUN npm run build
+
+# Drop the devDependencies from the tree the runtime stage inherits. Pruning
+# here rather than running a second `npm ci --omit=dev` below keeps the native
+# modules exactly as they were resolved and built once.
+RUN npm prune --omit=dev
+
+# ---------------------------------------------------------------------------------------
+# Stage 2 — runtime
+# ---------------------------------------------------------------------------------------
+FROM node:22-bookworm-slim AS runtime
+
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    HOST=0.0.0.0 \
+    PORT=4321
+
+# Both bind mounts, named here so the code's own `process.cwd()` defaults are
+# never what a container relies on. See docker-compose.yml.
+ENV BRAND_DIR=/app/brand \
+    DATA_DIR=/app/data
+
+# The stock brand, baked in and always complete (§7). Every /brand/* URL resolves
+# against the mount first and this second, per file.
+ENV BRAND_DEFAULT_DIR=/app/brand-default
+
+# `dist/` is owned by `node` because the boot rewrite WRITES to it: applyBrand.mjs
+# rewrites the prerendered HTML from what it last applied to what the mount now
+# says, records that in dist/.brand-applied.json, and re-indexes dist/client/pagefind
+# so search finds the mounted site name. A read-only dist would make §7's promise
+# — recolour and rename by copying a file — fail at boot with a permission error.
+COPY --from=build --chown=node:node /build/node_modules ./node_modules
+COPY --from=build --chown=node:node /build/dist ./dist
+COPY --from=build --chown=node:node /build/brand-default ./brand-default
+COPY --from=build --chown=node:node /build/scripts ./scripts
+COPY --from=build --chown=node:node /build/package.json ./package.json
+
+# `src/` is here for one reason: the tester-list CLI. §8 has no admin page by
+# design, so managing the closed beta is `docker compose exec site node
+# scripts/beta.mjs …`, and that reaches into src/lib/betaStore.mjs. Nothing
+# serving a request reads it — the pages were prerendered in stage 1.
+COPY --from=build --chown=node:node /build/src ./src
+
+# Both mount points exist in the image, owned by the runtime user. An operator
+# who forgets a mount then gets a working stock site and an empty store rather
+# than a container that will not start; and `data/` being writable by uid 1000
+# BEFORE Docker creates it is what stops the store failing to open. If the host
+# directory is owned by someone else, `chown 1000:1000 ./data` on the host.
+RUN mkdir -p /app/brand /app/data && chown -R node:node /app/brand /app/data
+
+USER node
+
+EXPOSE 4321
+
+# Cheap, and it tests the thing that actually breaks: `npm start` runs the brand
+# rewrite BEFORE the server, so a container can sit alive for a long moment with
+# nothing listening. A healthcheck that only watched the process would call that
+# healthy.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:' + (process.env.PORT || 4321) + '/').then((r) => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+
+# applyBrand.mjs, then serve.mjs. Not dist/server/entry.mjs directly — see the
+# header comment in scripts/serve.mjs for the adapter bug that wrapper exists for.
+CMD ["npm", "start"]