feat: added docker files to all repos and some basic tests

.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+.git
+.github
+.next
+dist
+*.md
+!README.md
+.env*
+.turbo
+apps/desktop

apps/api/Dockerfile

@@ -0,0 +1,16 @@
+FROM node:22-slim
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && corepack prepare pnpm@9.0.0 --activate
+
+WORKDIR /app
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
+COPY apps/api/ ./apps/api/
+COPY packages/ ./packages/
+RUN pnpm install --frozen-lockfile
+RUN pnpm --filter @repo/api build
+
+ENV NODE_ENV=production
+USER node
+EXPOSE 8080
+CMD ["node", "apps/api/dist/index.js"]

apps/api/package.json

@@ -7,7 +7,9 @@
     "dev": "tsx watch src/index.ts",
     "build": "tsup && tsc --declaration --emitDeclarationOnly --outDir dist",
     "start": "node dist/index.js",
-    "check-types": "tsc --noEmit"
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1004.0",

apps/api/src/__tests__/auth-guard.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest"
+import { client } from "./helpers"
+
+describe("Auth Guard — unauthenticated requests return 401", () => {
+  it("GET /v1/allies", async () => {
+    const res = await client.v1.allies.$get()
+    expect(res.status).toBe(401)
+  })
+
+  it("GET /v1/dms", async () => {
+    const res = await client.v1.dms.$get({
+      query: {
+        page: 1,
+        perPage: 50,
+      },
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it("GET /v1/blocks", async () => {
+    const res = await client.v1.blocks.$get()
+    expect(res.status).toBe(401)
+  })
+
+  it("GET /v1/notification-settings", async () => {
+    const res = await client.v1["notification-settings"].$get()
+    expect(res.status).toBe(401)
+  })
+
+  it("GET /v1/privacy-settings", async () => {
+    const res = await client.v1["privacy-settings"].$get()
+    expect(res.status).toBe(401)
+  })
+
+  it("POST /v1/allies/requests", async () => {
+    const res = await client.v1.allies.requests.$post({
+      json: { userId: "fake-id" },
+    })
+    expect(res.status).toBe(401)
+  })
+})

apps/api/src/__tests__/health.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest"
+import app from "@/app"
+
+describe("Health Check", () => {
+  it("GET / returns 200 with status ok", async () => {
+    const res = await app.request("/")
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ status: "ok" })
+  })
+
+  it("GET /unknown returns 404", async () => {
+    const res = await app.request("/this-does-not-exist")
+    expect(res.status).toBe(404)
+  })
+})

apps/api/src/__tests__/helpers.ts

@@ -0,0 +1,22 @@
+import type { ClientRequestOptions } from "hono/client"
+import { testClient } from "hono/testing"
+import app, { type AppType } from "@/app"
+
+/**
+ * Typed test client for the Townhall API.
+ * Provides autocomplete on routes, params, and response bodies.
+ */
+export const client = testClient<AppType>(app as unknown as AppType)
+/**
+ * Creates request options with a session cookie for authenticated requests.
+ *
+ * Usage:
+ *   const res = await client.v1.allies.$get(undefined, withSession(cookie))
+ */
+export function withSession(sessionCookie: string): ClientRequestOptions {
+  return {
+    headers: {
+      Cookie: sessionCookie,
+    },
+  }
+}

apps/api/vitest.config.ts

@@ -0,0 +1,14 @@
+import { resolve } from "node:path"
+import { defineConfig } from "vitest/config"
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["src/**/*.test.ts"],
+  },
+  resolve: {
+    alias: {
+      "@": resolve(__dirname, "src"),
+    },
+  },
+})

apps/realtime/Dockerfile

@@ -0,0 +1,16 @@
+FROM node:22-slim
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && corepack prepare pnpm@9.0.0 --activate
+
+WORKDIR /app
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
+COPY apps/realtime/ ./apps/realtime/
+COPY packages/ ./packages/
+RUN pnpm install --frozen-lockfile
+RUN pnpm --filter @repo/realtime build
+
+ENV NODE_ENV=production
+USER node
+EXPOSE 8000
+CMD ["node", "apps/realtime/dist/index.js"]

apps/worker/Dockerfile

@@ -0,0 +1,15 @@
+FROM node:22-slim
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable && corepack prepare pnpm@9.0.0 --activate
+
+WORKDIR /app
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
+COPY apps/worker/ ./apps/worker/
+COPY packages/ ./packages/
+RUN pnpm install --frozen-lockfile
+RUN pnpm --filter @repo/worker build
+
+ENV NODE_ENV=production
+USER node
+CMD ["node", "apps/worker/dist/index.js"]

docker-compose.yml

@@ -0,0 +1,116 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: townhall
+      POSTGRES_PASSWORD: townhall
+      POSTGRES_DB: townhall
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U townhall"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+
+  api:
+    build:
+      context: .
+      dockerfile: apps/api/Dockerfile
+    restart: unless-stopped
+    ports:
+      - "8080:8080"
+    environment:
+      NODE_ENV: production
+      PORT: 8080
+      DATABASE_URL: postgresql://townhall:townhall@postgres:5432/townhall
+      REDIS_URL: redis://redis:6379
+      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8080}
+      S3_ENDPOINT: ${S3_ENDPOINT}
+      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
+      S3_BUCKET_NAME: ${S3_BUCKET_NAME}
+      S3_REGION: ${S3_REGION:-auto}
+      S3_PUBLIC_URL: ${S3_PUBLIC_URL}
+      RESEND_API_KEY: ${RESEND_API_KEY}
+      EMAIL_FROM: ${EMAIL_FROM:-Townhall <noreply@team.townhall.chat>}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  realtime:
+    build:
+      context: .
+      dockerfile: apps/realtime/Dockerfile
+    restart: unless-stopped
+    ports:
+      - "8000:8000"
+    environment:
+      NODE_ENV: production
+      REALTIME_PORT: 8000
+      DATABASE_URL: postgresql://townhall:townhall@postgres:5432/townhall
+      REDIS_URL: redis://redis:6379
+      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8080}
+      REALTIME_CORS_ORIGIN: ${REALTIME_CORS_ORIGIN:-http://localhost:3000,http://localhost:3001}
+      S3_ENDPOINT: ${S3_ENDPOINT}
+      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
+      S3_BUCKET_NAME: ${S3_BUCKET_NAME}
+      S3_REGION: ${S3_REGION:-auto}
+      S3_PUBLIC_URL: ${S3_PUBLIC_URL}
+      RESEND_API_KEY: ${RESEND_API_KEY}
+      EMAIL_FROM: ${EMAIL_FROM:-Townhall <noreply@team.townhall.chat>}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  worker:
+    build:
+      context: .
+      dockerfile: apps/worker/Dockerfile
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      DATABASE_URL: postgresql://townhall:townhall@postgres:5432/townhall
+      REDIS_URL: redis://redis:6379
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:8080}
+      S3_ENDPOINT: ${S3_ENDPOINT}
+      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
+      S3_BUCKET_NAME: ${S3_BUCKET_NAME}
+      S3_REGION: ${S3_REGION:-auto}
+      S3_PUBLIC_URL: ${S3_PUBLIC_URL}
+      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET}
+      RESEND_API_KEY: ${RESEND_API_KEY}
+      EMAIL_FROM: ${EMAIL_FROM:-Townhall <noreply@team.townhall.chat>}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+volumes:
+  postgres_data:
+  redis_data:

package.json

@@ -10,6 +10,7 @@
     "generate:auth-schema": "pnpm --filter @repo/auth exec npx @better-auth/cli@latest generate --output ../../packages/db/src/generated-schema.ts",
     "db:push": "pnpm --filter @repo/db db:push",
     "db:studio": "pnpm --filter @repo/db db:studio",
+    "test": "turbo run test",
     "desktop": "pnpm --filter desktop dev",
     "prepare": "husky"
   },
@@ -18,7 +19,8 @@
     "@types/node": "^25.2.2",
     "husky": "^9.1.7",
     "turbo": "^2.8.3",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "vitest": "^4.1.2"
   },
   "packageManager": "pnpm@9.0.0",
   "engines": {

packages/auth/src/lib/auth.ts

@@ -149,7 +149,7 @@ export const auth = betterAuth({
             <div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; max-width: 480px; margin: 0 auto; padding: 32px 0;">
               <h2 style="margin: 0 0 8px; font-size: 24px; color: #1a1a1a;">Reset Your Password</h2>
               <p style="margin: 0 0 24px; color: #555; font-size: 16px; line-height: 1.5;">Click the button below to reset your password.</p>
-              <a href="${url}" style="display: inline-block; background: #8B6914; color: #fff; padding: 12px 28px; border-radius: 8px; text-decoration: none; font-weight: 600; font-size: 16px;">Reset Password</a>
+              <a href="${url}" style="display: inline-block; background: #994920; color: #fff; padding: 12px 28px; border-radius: 8px; text-decoration: none; font-weight: 600; font-size: 16px;">Reset Password</a>
               <p style="color: #999; font-size: 13px; margin-top: 24px; line-height: 1.4;">If you didn't request a password reset, you can safely ignore this email.</p>
             </div>
           `,
@@ -177,7 +177,7 @@ export const auth = betterAuth({
             <div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; max-width: 480px; margin: 0 auto; padding: 32px 0;">
               <h2 style="margin: 0 0 8px; font-size: 24px; color: #1a1a1a;">Welcome to Townhall</h2>
               <p style="margin: 0 0 24px; color: #555; font-size: 16px; line-height: 1.5;">Click the button below to verify your email address and get started.</p>
-              <a href="${url}" style="display: inline-block; background: #8B6914; color: #fff; padding: 12px 28px; border-radius: 8px; text-decoration: none; font-weight: 600; font-size: 16px;">Verify Email</a>
+              <a href="${url}" style="display: inline-block; background: #994920; color: #fff; padding: 12px 28px; border-radius: 8px; text-decoration: none; font-weight: 600; font-size: 16px;">Verify Email</a>
               <p style="color: #999; font-size: 13px; margin-top: 24px; line-height: 1.4;">If you didn't create a Townhall account, you can safely ignore this email.</p>
             </div>
           `,