feat: Production Docker, Security Hardening, BullMQ Queues & Swagger DTOs

.env.example

@@ -0,0 +1,58 @@
+# ── Application ──────────────────────────────────────────────────────────────
+NODE_ENV=development
+PORT=6006
+
+# ── Database (required) ───────────────────────────────────────────────────────
+DATABASE_HOST=localhost
+DATABASE_PORT=5432
+DATABASE_USERNAME=postgres
+DATABASE_PASSWORD=changeme
+DATABASE_NAME=freightflow
+
+# ── Auth (required) ───────────────────────────────────────────────────────────
+JWT_SECRET=change-me-in-production
+JWT_EXPIRES_IN=15m
+JWT_REFRESH_SECRET=change-me-in-production-refresh
+
+# ── Redis (required) ──────────────────────────────────────────────────────────
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=
+REDIS_URL=redis://localhost:6379
+
+# ── Frontend ──────────────────────────────────────────────────────────────────
+FRONTEND_URL=http://localhost:3000
+NEXT_PUBLIC_API_URL=http://localhost:6006
+
+# ── Cloudinary (required for image upload) ────────────────────────────────────
+CLOUDINARY_CLOUD_NAME=
+CLOUDINARY_API_KEY=
+CLOUDINARY_API_SECRET=
+
+# ── Mailer ────────────────────────────────────────────────────────────────────
+MAILER_HOST=smtp.example.com
+MAILER_PORT=587
+MAILER_USER=noreply@example.com
+MAILER_PASS=
+
+# ── Twilio (optional – SMS notifications) ─────────────────────────────────────
+TWILIO_ACCOUNT_SID=
+TWILIO_AUTH_TOKEN=
+TWILIO_PHONE_NUMBER=
+
+# ── Web Push (optional) ───────────────────────────────────────────────────────
+WEB_PUSH_PUBLIC_KEY=
+WEB_PUSH_PRIVATE_KEY=
+WEB_PUSH_EMAIL=
+
+# ── Stellar / Soroban (optional) ──────────────────────────────────────────────
+STELLAR_NETWORK=testnet
+STELLAR_SECRET_KEY=
+STELLAR_SHIPMENT_CONTRACT=
+STELLAR_ESCROW_CONTRACT=
+STELLAR_DOCUMENT_CONTRACT=
+STELLAR_REPUTATION_CONTRACT=
+STELLAR_IDENTITY_CONTRACT=
+
+# ── Platform ──────────────────────────────────────────────────────────────────
+PLATFORM_FEE_PERCENT=2.5

.github/workflows/backend-ci.yml

@@ -0,0 +1,64 @@
+name: Backend CI
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  backend:
+    name: Backend (NestJS)
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:15
+        env:
+          POSTGRES_DB: freightflow_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    defaults:
+      run:
+        working-directory: backend
+
+    env:
+      DATABASE_HOST: localhost
+      DATABASE_PORT: 5432
+      DATABASE_USERNAME: postgres
+      DATABASE_PASSWORD: postgres
+      DATABASE_NAME: freightflow_test
+      JWT_SECRET: ci-test-secret
+      REDIS_URL: redis://localhost:6379
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: backend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Unit tests
+        run: npm run test -- --passWithNoTests
+
+      - name: Build
+        run: npm run build
+
+      - name: Migration dry-run
+        run: npm run migration:run

.github/workflows/frontend-ci.yml

@@ -0,0 +1,39 @@
+name: Frontend CI
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  frontend:
+    name: Frontend (Next.js)
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: frontend
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type-check
+        run: npx tsc --noEmit
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Build
+        run: npm run build
+        env:
+          NEXT_PUBLIC_API_URL: http://localhost:3001

backend/.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true

backend/Dockerfile

@@ -0,0 +1,15 @@
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:20-alpine AS runner
+WORKDIR /app
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/package*.json ./
+RUN npm ci --omit=dev
+USER node
+EXPOSE 6006
+CMD ["sh", "-c", "npm run migration:run && node dist/main.js"]