fix: simplify Docker build workflow, remove PREBUILT artifact workaround

- Remove UI build artifact upload/download steps (18 lines removed)
- Remove .dockerignore manipulation workaround
- Always build UI from source inside Docker (more reliable)
- Remove PREBUILT arg from ui/Dockerfile and docker-bake.hcl

This fixes the '/app/build not found' error in CI by eliminating the fragile
artifact-passing mechanism. UI now builds fresh in Docker using build cache,
same as local development.

.gitea/workflows/ci.yaml

@@ -41,6 +41,9 @@ jobs:
       - name: Build healthcheck
         run: go build -o /dev/null ./cmd/healthcheck
 
+      - name: Build pocketbase
+        run: go build -o /dev/null ./cmd/pocketbase
+
       - name: Run tests
         run: go test -short -race -count=1 -timeout=60s ./...
 

.gitea/workflows/release.yaml

@@ -55,102 +55,7 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Upload build artifacts
+  # ── docker: build + push all images via docker bake ──────────────────────────
-        uses: actions/upload-artifact@v3
-        with:
-          name: ui-build
-          path: ui/build
-          retention-days: 1
-
-  # ── ui: source map upload ─────────────────────────────────────────────────────
-  # Commented out — re-enable when GlitchTip source map uploads are needed again.
-  #
-  # upload-sourcemaps:
-  #   name: Upload source maps
-  #   runs-on: ubuntu-latest
-  #   needs: [check-ui]
-  #   steps:
-  #     - name: Compute release version (strip leading v)
-  #       id: ver
-  #       run: |
-  #         V="${{ gitea.ref_name }}"
-  #         echo "version=${V#v}" >> "$GITHUB_OUTPUT"
-  #
-  #     - name: Download build artifacts
-  #       uses: actions/download-artifact@v3
-  #       with:
-  #         name: ui-build
-  #         path: build
-  #
-  #     - name: Install sentry-cli
-  #       run: npm install -g @sentry/cli
-  #
-  #     - name: Inject debug IDs into build artifacts
-  #       run: sentry-cli sourcemaps inject ./build
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Upload injected build (for docker-ui)
-  #       uses: actions/upload-artifact@v3
-  #       with:
-  #         name: ui-build-injected
-  #         path: build
-  #         retention-days: 1
-  #
-  #     - name: Create GlitchTip release
-  #       run: sentry-cli releases new ${{ steps.ver.outputs.version }}
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Upload source maps to GlitchTip
-  #       run: sentry-cli sourcemaps upload ./build --release ${{ steps.ver.outputs.version }}
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Finalize GlitchTip release
-  #       run: sentry-cli releases finalize ${{ steps.ver.outputs.version }}
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc/
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-  #
-  #     - name: Prune old GlitchTip releases (keep latest 10)
-  #       run: |
-  #         set -euo pipefail
-  #         KEEP=10
-  #         OLD=$(curl -sf \
-  #           -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" \
-  #           "$SENTRY_URL/api/0/organizations/$SENTRY_ORG/releases/?project=$SENTRY_PROJECT&per_page=100" \
-  #           | python3 -c "
-  #         import sys, json
-  #         releases = json.load(sys.stdin)
-  #         for r in releases[$KEEP:]:
-  #             print(r['version'])
-  #         " KEEP=$KEEP)
-  #         for ver in $OLD; do
-  #           echo "Deleting old release: $ver"
-  #           sentry-cli releases delete "$ver" || true
-  #         done
-  #       env:
-  #         SENTRY_URL: https://errors.libnovel.cc
-  #         SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
-  #         SENTRY_ORG: libnovel
-  #         SENTRY_PROJECT: ui
-
-  # ── docker: all images in one job (single login) ──────────────────────────────
-  # backend, runner, ui, and caddy are built sequentially in one job so Docker
-  # Hub only needs to be authenticated once. This also eliminates 3 redundant
-  # checkout + setup-buildx + scheduler round-trips compared to separate jobs.
   docker:
     name: Docker
     runs-on: ubuntu-latest
@@ -160,121 +65,72 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
-      # Single login — credential is written to ~/.docker/config.json and
-      # reused by all subsequent build-push-action steps in this job.
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
 
-      # ── backend ──────────────────────────────────────────────────────────────
+      - name: Compute version tags
-      - name: Docker meta / backend
+        id: ver
-        id: meta-backend
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-backend
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Build and push / backend
-        uses: docker/build-push-action@v6
-        with:
-          context: backend
-          target: backend
-          push: true
-          tags: ${{ steps.meta-backend.outputs.tags }}
-          labels: ${{ steps.meta-backend.outputs.labels }}
-          build-args: |
-            VERSION=${{ steps.meta-backend.outputs.version }}
-            COMMIT=${{ gitea.sha }}
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-backend:latest
-          cache-to: type=inline
-
-      # ── runner ───────────────────────────────────────────────────────────────
-      - name: Docker meta / runner
-        id: meta-runner
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-runner
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
-
-      - name: Build and push / runner
-        uses: docker/build-push-action@v6
-        with:
-          context: backend
-          target: runner
-          push: true
-          tags: ${{ steps.meta-runner.outputs.tags }}
-          labels: ${{ steps.meta-runner.outputs.labels }}
-          build-args: |
-            VERSION=${{ steps.meta-runner.outputs.version }}
-            COMMIT=${{ gitea.sha }}
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-runner:latest
-          cache-to: type=inline
-
-      # ── ui ───────────────────────────────────────────────────────────────────
-      - name: Download ui build artifacts
-        uses: actions/download-artifact@v3
-        with:
-          name: ui-build
-          path: ui/build
-
-      - name: Allow build/ into Docker context (override .dockerignore)
         run: |
-          grep -v '^build$' ui/.dockerignore > ui/.dockerignore.tmp
+          V="${{ gitea.ref_name }}"
-          mv ui/.dockerignore.tmp ui/.dockerignore
+          VER="${V#v}"
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "major_minor=$(echo "$VER" | cut -d. -f1-2)" >> "$GITHUB_OUTPUT"
 
-      - name: Docker meta / ui
+      - name: Build and push all images
-        id: meta-ui
+        uses: docker/bake-action@v6
-        uses: docker/metadata-action@v5
         with:
-          images: ${{ secrets.DOCKER_USER }}/libnovel-ui
+          files: docker-bake.hcl
-          tags: |
+          set: |
-            type=semver,pattern={{version}}
+            *.output=type=image,push=true
-            type=semver,pattern={{major}}.{{minor}}
+        env:
-            type=raw,value=latest
+          VERSION: ${{ steps.ver.outputs.version }}
+          MAJOR_MINOR: ${{ steps.ver.outputs.major_minor }}
+          COMMIT: ${{ gitea.sha }}
+          BUILD_TIME: ${{ gitea.event.head_commit.timestamp }}
 
-      - name: Build and push / ui
+  # ── deploy: sync docker-compose.yml + restart prod ───────────────────────────
-        uses: docker/build-push-action@v6
+  # Runs after all images are pushed to Docker Hub.
-        with:
+  # Copies the compose file from the tagged commit to the server, pulls the new
-          context: ui
+  # images, and restarts only the services whose image or config changed.
-          push: true
+  # --remove-orphans cleans up containers no longer defined in the compose file
-          tags: ${{ steps.meta-ui.outputs.tags }}
+  # (e.g. the now-removed pb-init container).
-          labels: ${{ steps.meta-ui.outputs.labels }}
+  #
-          build-args: |
+  # Required Gitea secrets:
-            BUILD_VERSION=${{ steps.meta-ui.outputs.version }}
+  #   PROD_HOST             — prod server IP or hostname
-            BUILD_COMMIT=${{ gitea.sha }}
+  #   PROD_USER             — SSH login user (typically root)
-            BUILD_TIME=${{ gitea.event.head_commit.timestamp }}
+  #   PROD_SSH_KEY          — private key whose public half is in authorized_keys
-            PREBUILT=1
+  #   PROD_SSH_KNOWN_HOSTS  — output of: ssh-keyscan -H <PROD_HOST>
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-ui:latest
+  deploy:
-          cache-to: type=inline
+    name: Deploy to prod
+    runs-on: ubuntu-latest
+    needs: [docker]
+    steps:
+      - uses: actions/checkout@v4
 
-      # ── caddy ────────────────────────────────────────────────────────────────
+      - name: Install SSH key
-      - name: Docker meta / caddy
+        run: |
-        id: meta-caddy
+          mkdir -p ~/.ssh
-        uses: docker/metadata-action@v5
+          printf '%s\n' "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/deploy_key
-        with:
+          chmod 600 ~/.ssh/deploy_key
-          images: ${{ secrets.DOCKER_USER }}/libnovel-caddy
+          printf '%s\n' "${{ secrets.PROD_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
 
-      - name: Build and push / caddy
+      - name: Copy docker-compose.yml to prod
-        uses: docker/build-push-action@v6
+        run: |
-        with:
+          scp -i ~/.ssh/deploy_key \
-          context: caddy
+            docker-compose.yml \
-          push: true
+            "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}:/opt/libnovel/docker-compose.yml"
-          tags: ${{ steps.meta-caddy.outputs.tags }}
+
-          labels: ${{ steps.meta-caddy.outputs.labels }}
+      - name: Pull new images and restart changed services
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-caddy:latest
+        run: |
-          cache-to: type=inline
+          ssh -i ~/.ssh/deploy_key \
+            "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
+            'set -euo pipefail
+             cd /opt/libnovel
+             doppler run -- docker compose pull backend runner ui caddy pocketbase
+             doppler run -- docker compose up -d --remove-orphans'
 
   # ── Gitea release ─────────────────────────────────────────────────────────────
   release:

CLAUDE.md

@@ -2,6 +2,17 @@
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
+## Environment / Secrets
+
+All project environment variables are stored in **Doppler**. When you need to access any secret or env var (e.g. API tokens, database URLs, credentials), fetch them via:
+
+```bash
+doppler run -- <command>        # inject all secrets into a command
+doppler secrets get SECRET_NAME # inspect a specific secret
+```
+
+Never use `.env` files. Do not ask the user to provide secrets manually — they are available via Doppler.
+
 ## Commands
 
 ### Docker (via `just` — the primary way to run services)

backend/Dockerfile

@@ -48,13 +48,11 @@ ENTRYPOINT ["/backend"]
 # On every `serve` startup it applies any pending migrations automatically.
 # Data is stored in /pb_data (mounted as a Docker volume in production).
 FROM alpine:3.21 AS pocketbase
-RUN apk add --no-cache ca-certificates && \
+RUN apk add --no-cache ca-certificates wget
-    addgroup -S appgroup && adduser -S appuser -G appgroup
 COPY --from=builder /out/pocketbase /pocketbase
-RUN mkdir -p /pb_data && chown appuser:appgroup /pb_data
+RUN mkdir -p /pb_data
 VOLUME /pb_data
 EXPOSE 8090
-USER appuser
 CMD ["/pocketbase", "serve", "--dir", "/pb_data", "--http", "0.0.0.0:8090"]
 
 # ── runner service ───────────────────────────────────────────────────────────

backend/migrations/20260414000001_initial_schema.go

@@ -81,7 +81,7 @@ func saveIfAbsent(app core.App, c *core.Collection) error {
 	if _, err := app.FindCollectionByNameOrId(c.Name); err == nil {
 		return nil // already exists — skip
 	}
-	return saveIfAbsent(app, c)
+	return app.Save(c)
 }
 
 // ── Collection creators ───────────────────────────────────────────────────────

docker-bake.hcl

@@ -0,0 +1,106 @@
+# docker-bake.hcl — defines all five production images.
+#
+# CI passes version info as environment variables; locally everything gets :dev tags.
+#
+# Local build (no push):
+#   docker buildx bake
+#
+# CI environment variables: VERSION, MAJOR_MINOR, COMMIT, BUILD_TIME
+
+variable "DOCKER_USER"  { default = "kalekber" }
+variable "VERSION"      { default = "dev" }    # e.g. "4.1.6"  (no leading v)
+variable "MAJOR_MINOR"  { default = "dev" }    # e.g. "4.1"
+variable "COMMIT"       { default = "unknown" }
+variable "BUILD_TIME"   { default = "" }
+
+# ── Shared defaults ───────────────────────────────────────────────────────────
+
+target "_defaults" {
+  pull     = true
+  # CI overrides to push=true via --set *.output=type=image,push=true
+  output   = ["type=image,push=false"]
+  cache-to = ["type=inline"]
+}
+
+# ── Go targets (share the backend/ build context + builder stage) ─────────────
+
+target "backend" {
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "backend"
+  tags       = [
+    "${DOCKER_USER}/libnovel-backend:${VERSION}",
+    "${DOCKER_USER}/libnovel-backend:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-backend:latest",
+  ]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-backend:latest"]
+  args = {
+    VERSION = VERSION
+    COMMIT  = COMMIT
+  }
+}
+
+target "runner" {
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "runner"
+  tags       = [
+    "${DOCKER_USER}/libnovel-runner:${VERSION}",
+    "${DOCKER_USER}/libnovel-runner:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-runner:latest",
+  ]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-runner:latest"]
+  args = {
+    VERSION = VERSION
+    COMMIT  = COMMIT
+  }
+}
+
+target "pocketbase" {
+  inherits   = ["_defaults"]
+  context    = "backend"
+  target     = "pocketbase"
+  tags       = [
+    "${DOCKER_USER}/libnovel-pocketbase:${VERSION}",
+    "${DOCKER_USER}/libnovel-pocketbase:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-pocketbase:latest",
+  ]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-pocketbase:latest"]
+}
+
+# ── UI (SvelteKit — separate context) ────────────────────────────────────────
+
+target "ui" {
+  inherits   = ["_defaults"]
+  context    = "ui"
+  tags       = [
+    "${DOCKER_USER}/libnovel-ui:${VERSION}",
+    "${DOCKER_USER}/libnovel-ui:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-ui:latest",
+  ]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-ui:latest"]
+  args = {
+    BUILD_VERSION = VERSION
+    BUILD_COMMIT  = COMMIT
+    BUILD_TIME    = BUILD_TIME
+  }
+}
+
+# ── Caddy (custom plugins — separate context) ─────────────────────────────────
+
+target "caddy" {
+  inherits   = ["_defaults"]
+  context    = "caddy"
+  tags       = [
+    "${DOCKER_USER}/libnovel-caddy:${VERSION}",
+    "${DOCKER_USER}/libnovel-caddy:${MAJOR_MINOR}",
+    "${DOCKER_USER}/libnovel-caddy:latest",
+  ]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-caddy:latest"]
+}
+
+# ── Default group: all five images ────────────────────────────────────────────
+
+group "default" {
+  targets = ["backend", "runner", "pocketbase", "ui", "caddy"]
+}

docker-compose.yml

@@ -91,11 +91,12 @@ services:
       test: ["CMD", "wget", "-qO-", "http://localhost:8090/api/health"]
       interval: 10s
       timeout: 5s
-      retries: 5
+      retries: 10
+      start_period: 30s
 
   # ─── Meilisearch (full-text search) ──────────────────────────────────────────
   meilisearch:
-    image: getmeili/meilisearch:latest
+    image: getmeili/meilisearch:v1.40.0
     restart: unless-stopped
     environment:
       MEILI_MASTER_KEY: "${MEILI_MASTER_KEY}"

justfile

@@ -63,7 +63,7 @@ build-push: build push
 
 # Pull all images from Docker Hub (uses GIT_TAG from Doppler)
 pull-images:
-    {{doppler}} docker compose pull backend runner ui caddy
+    {{doppler}} docker compose pull backend runner ui caddy pocketbase
 
 # Pull all third-party base images (minio, pocketbase, etc.)
 pull-infra:

ui/Dockerfile

@@ -21,11 +21,7 @@ ENV PUBLIC_BUILD_VERSION=$BUILD_VERSION
 ENV PUBLIC_BUILD_COMMIT=$BUILD_COMMIT
 ENV PUBLIC_BUILD_TIME=$BUILD_TIME
 
-# PREBUILT=1 skips npm run build — used in CI when the build/ directory has
+RUN npm run build
-# already been compiled (and debug IDs injected) by a prior job.  The caller
-# must copy the pre-built build/ into the Docker context before building.
-ARG PREBUILT=0
-RUN [ "$PREBUILT" = "1" ] || npm run build
 
 # ── Runtime image ──────────────────────────────────────────────────────────────
 # adapter-node bundles most server-side code, but packages with dynamic