UPD: initial architecture

Dockerfile

@@ -0,0 +1,36 @@
+FROM node:24-alpine AS base
+RUN corepack enable && corepack prepare pnpm@10.13.1 --activate
+WORKDIR /app
+
+FROM base AS dependencies
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+
+FROM base AS production-dependencies
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --prod --frozen-lockfile
+
+FROM dependencies AS builder
+COPY . .
+# Next evaluates route modules while building. These inert values only satisfy
+# configuration parsing at build time; Compose/runtime values replace them.
+ENV APP_URL=http://build.local \
+    DATABASE_URL=postgresql://build:build@localhost:5432/build \
+    BETTER_AUTH_SECRET=build-only-secret-that-is-at-least-thirty-two-characters \
+    BETTER_AUTH_URL=http://build.local
+RUN pnpm build
+
+FROM node:24-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production PORT=3000 HOSTNAME=0.0.0.0
+RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 beacon
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=beacon:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=beacon:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=beacon:nodejs /app/drizzle ./drizzle
+COPY --from=builder --chown=beacon:nodejs /app/scripts ./scripts
+COPY --from=production-dependencies --chown=beacon:nodejs /app/node_modules ./node_modules
+USER beacon
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD node -e "fetch('http://localhost:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+ENTRYPOINT ["/bin/sh", "./scripts/entrypoint.sh"]