From 015386ba4aff75d57c1fb5317bf6b8e99f2002c6 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Fri, 10 Apr 2026 13:13:00 +0200
Subject: [PATCH] fix(deploy): pass build-time secrets and fix standalone path
 resolution

---
 .gitea/workflows/deploy.yml | 2 ++
 Dockerfile                  | 9 +++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index fae0471..30595e1 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -316,6 +316,8 @@ jobs:
             S3_BUCKET=${{ secrets.S3_BUCKET || vars.S3_BUCKET || 'mintel' }}
             S3_REGION=${{ secrets.S3_REGION || vars.S3_REGION || 'fsn1' }}
             S3_PREFIX=${{ secrets.S3_PREFIX || vars.S3_PREFIX || 'mintel.me' }}
+            DATABASE_URI=${{ secrets.DATABASE_URI || (needs.prepare.outputs.target == 'testing' && secrets.TESTING_DIRECTUS_DB_PASSWORD && format('postgres://directus:{0}@postgres-db:5432/directus', secrets.TESTING_DIRECTUS_DB_PASSWORD)) || 'postgres://payload:payload@postgres-db:5432/payload' }}
+            PAYLOAD_SECRET=${{ secrets.PAYLOAD_SECRET || 'secret' }}
             BUILD_ID=${{ github.sha }}
           tags: registry.infra.mintel.me/mintel/mintel.me:${{ needs.prepare.outputs.image_tag }}
           cache-from: type=registry,ref=registry.infra.mintel.me/mintel/mintel.me:buildcache-${{ needs.prepare.outputs.target }}
diff --git a/Dockerfile b/Dockerfile
index 697e613..2e0bb6f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,6 +13,8 @@ ARG S3_SECRET_KEY
 ARG S3_BUCKET
 ARG S3_REGION
 ARG S3_PREFIX
+ARG DATABASE_URI
+ARG PAYLOAD_SECRET
 ARG BUILD_ID
 
 # Environment variables for Next.js build
@@ -25,6 +27,8 @@ ENV S3_SECRET_KEY=$S3_SECRET_KEY
 ENV S3_BUCKET=$S3_BUCKET
 ENV S3_REGION=$S3_REGION
 ENV S3_PREFIX=$S3_PREFIX
+ENV DATABASE_URI=$DATABASE_URI
+ENV PAYLOAD_SECRET=$PAYLOAD_SECRET
 ENV SKIP_RUNTIME_ENV_VALIDATION=true
 ENV CI=true
 
@@ -78,5 +82,6 @@ RUN chown -R 1001:65533 /app
 USER nextjs
 
 # Start from the app directory to ensure references solve correctly
-WORKDIR /app/apps/web
-CMD ["node", "server.js"]
+# In Standalone mode, Next.js expects node_modules and public relative to the server.js
+WORKDIR /app
+CMD ["node", "apps/web/server.js"]