Containerize webapp + deploy to Oracle/Dokploy via GHCR

[oliverhuangcode]

Migrate the mploy webapp off its current host to a Docker container on the Oracle Cloud VM, deployed by Dokploy from an image built in GitHub Actions and pushed to GHCR. Mirrors the monmap migration, adapted to this repo's stack.

What this repo actually is (vs monmap)

• Next.js 16 (App Router) in frontend/, npm (not pnpm), not a monorepo — frontend/ is a self-contained npm app; the Spring Boot backend/ is a separate service. So: build context is frontend/, no Corepack/pnpm pinning, no transpilePackages.
• No NEXT_PUBLIC_* build vars (GA id is hardcoded) → the image takes zero build-args.
• next build does not touch MongoDB — every DB route is force-dynamic or reads searchParams (/jobs renders ƒ Dynamic). Verified by building with no MONGODB_URI. All DB/auth/Notion values are runtime env in Dokploy.

Changes

• frontend/Dockerfile — multi-stage (deps → build → runner), node:22-slim, non-root nextjs user, runs the Next standalone server (node server.js).
• frontend/next.config.ts — pin outputFileTracingRoot to the app dir so the standalone entrypoint lands at .next/standalone/server.js (the empty root package-lock.json would otherwise nest it under frontend/); keep serverExternalPackages.
• frontend/.dockerignore — lean, deterministic build context.
• .github/workflows/deploy.yml — build linux/arm64 on ubuntu-24.04-arm, push ghcr.io/monashcoding/mploy:latest + a sha tag with type=gha cache, then POST the Dokploy webhook. Triggers on push to production. The redeploy step self-skips until the DOKPLOY_DEPLOY_WEBHOOK secret exists.
• docs/deploy.md — Dokploy runbook: Docker provider on ghcr.io/monashcoding/mploy:latest, runtime env vars, port 3000, domain jobs.monashcoding.com, Cloudflare grey-cloud-first so Let's Encrypt can issue the cert.

Verified locally

• npm ci + npm run build (production) pass; TypeScript check passes as part of the build.
• Build with no MONGODB_URI succeeds → build doesn't reach the DB.
• .next/standalone/server.js lands flat at the root, matching the Dockerfile CMD.
• Did not start a long-running server.

Follow-up (out of band, not in this PR)

• Set repo secret DOKPLOY_DEPLOY_WEBHOOK after the Dokploy app is created.
• Make the GHCR package public (or give Dokploy a read:packages token).
• Domain confirmed as jobs.monashcoding.com; MongoDB is external (Atlas) — no on-box private-IP caveat.

🤖 Generated with Claude Code