Harden production Docker stack for MySQL, API proxy, and builds.

Keep MySQL internal-only with env-based credentials, proxy /api/backend through nginx with Docker DNS refresh, and support host SOCKS/HTTP proxy during image builds.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/Dockerfile

@@ -0,0 +1,53 @@
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+# Build-time proxy (host SOCKS on 127.0.0.1:1081 — requires docker build --network=host)
+ARG HTTP_PROXY
+ARG HTTPS_PROXY
+ARG ALL_PROXY
+ENV HTTP_PROXY=$HTTP_PROXY \
+    HTTPS_PROXY=$HTTPS_PROXY \
+    ALL_PROXY=$ALL_PROXY \
+    NODE_OPTIONS=--dns-result-order=ipv4first
+
+COPY package*.json ./
+COPY prisma ./prisma/
+
+RUN npm ci
+
+COPY . .
+RUN npm run build
+
+FROM node:20-alpine
+
+WORKDIR /app
+
+ARG HTTP_PROXY
+ARG HTTPS_PROXY
+ARG ALL_PROXY
+ENV HTTP_PROXY=$HTTP_PROXY \
+    HTTPS_PROXY=$HTTPS_PROXY \
+    ALL_PROXY=$ALL_PROXY \
+    NODE_OPTIONS=--dns-result-order=ipv4first
+
+RUN apk add --no-cache openssl
+
+COPY package*.json ./
+COPY prisma ./prisma/
+
+# Keep devDependencies (tsx) so `prisma db seed` works on container start
+RUN npm ci
+
+# Do not keep proxy env in the final runtime image
+ENV HTTP_PROXY= \
+    HTTPS_PROXY= \
+    ALL_PROXY=
+
+COPY --from=builder /app/dist ./dist
+# Seed runs via tsx and imports application modules from src/
+COPY --from=builder /app/src ./src
+
+EXPOSE 3001
+
+CMD ["sh", "-c", "npx prisma migrate deploy && npx prisma db seed && node dist/server.js"]