build(web): run diskpush.com under Bun on dev2

.dockerignore

@@ -0,0 +1,14 @@
+# .git stays IN the context on purpose: app/sitemap.ts reads each page's
+# lastmod from `git log` at build time.
+node_modules
+apps/*/node_modules
+packages/*/node_modules
+apps/*/.next
+apps/desktop/out
+apps/desktop/dist-electron
+packages/*/dist
+apps/cli/dist
+release
+.shots
+.env*
+**/.env*

.github/workflows/ci.yml

@@ -49,6 +49,57 @@ jobs:
       - name: Desktop starts
         run: pnpm smoke:desktop
 
+  # diskpush.com runs on dev2 as Next's standalone server under Bun (see
+  # .nixpacks/Dockerfile). Build it the way the image does (Node + pnpm, web
+  # only), then boot it under Bun and read the pages that come off disk at
+  # request time or go through the crawl-gateway middleware.
+  web-bun:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # app/sitemap.ts dates each page from `git log`.
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
+
+      - run: pnpm install --frozen-lockfile --prod=false --filter @diskpush/web...
+      - run: pnpm --filter @diskpush/web build
+
+      - name: Boot the standalone server under Bun
+        run: |
+          s=apps/web/.next/standalone
+          cp -r apps/web/public "$s/apps/web/public"
+          cp -r apps/web/.next/static "$s/apps/web/.next/static"
+          test -f "$s/docs/install.md" && test -f "$s/scripts/install.sh"
+          (cd "$s" && PORT=3999 HOSTNAME=127.0.0.1 bun apps/web/server.js > /tmp/web.log 2>&1 &)
+          for i in $(seq 1 30); do
+            curl -sf -o /dev/null http://127.0.0.1:3999/ && break
+            sleep 1
+          done
+          for p in / /docs /docs/install /docs/cli /security /privacy /install.sh /llms.txt /robots.txt /sitemap.xml /.well-known/security.txt /manifest.json; do
+            code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:3999$p")
+            echo "$p $code"
+            [ "$code" = 200 ] || { cat /tmp/web.log; exit 1; }
+          done
+          # An unknown slug is read from docs/ at request time: 404, not 500.
+          code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3999/docs/no-such-doc)
+          echo "/docs/no-such-doc $code"; [ "$code" = 404 ]
+          grep -q 'SITE=' <(curl -s http://127.0.0.1:3999/install.sh)
+          # The crawl gateway in middleware answers AI training crawlers 402.
+          code=$(curl -s -o /dev/null -w '%{http_code}' -A GPTBot http://127.0.0.1:3999/)
+          echo "GPTBot $code"; [ "$code" = 402 ]
+          cat /tmp/web.log
+
   integration:
     runs-on: ubuntu-latest
     steps:

.nixpacks/Dockerfile

@@ -1,35 +1,35 @@
-FROM ghcr.io/railwayapp/nixpacks:ubuntu-1745885067
-
-ENTRYPOINT ["/bin/bash", "-l", "-c"]
-WORKDIR /app/
-
-
-COPY .nixpacks/nixpkgs-23f9169c4ccce521379e602cc82ed873a1f1b52b.nix .nixpacks/nixpkgs-23f9169c4ccce521379e602cc82ed873a1f1b52b.nix
-RUN nix-env -if .nixpacks/nixpkgs-23f9169c4ccce521379e602cc82ed873a1f1b52b.nix && nix-collect-garbage -d
-
-
-ARG CI NIXPACKS_METADATA NODE_ENV NPM_CONFIG_PRODUCTION
-ENV CI=$CI NIXPACKS_METADATA=$NIXPACKS_METADATA NODE_ENV=$NODE_ENV NPM_CONFIG_PRODUCTION=$NPM_CONFIG_PRODUCTION
-
-# setup phase
-# noop
-
-# install phase
-ENV NIXPACKS_PATH=/app/node_modules/.bin:$NIXPACKS_PATH
-COPY . /app/.
-RUN --mount=type=cache,id=8nFwAs26cBU-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 npm install -g corepack@0.36.0 && corepack enable
-RUN --mount=type=cache,id=8nFwAs26cBU-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 pnpm install --frozen-lockfile --prod=false --filter @diskpush/web...
-
-# build phase
-COPY . /app/.
-RUN --mount=type=cache,id=8nFwAs26cBU-apps/desktop/next/cache,target=/app/apps/desktop/.next/cache --mount=type=cache,id=8nFwAs26cBU-apps/web/next/cache,target=/app/apps/web/.next/cache --mount=type=cache,id=8nFwAs26cBU-node_modules/cache,target=/app/node_modules/.cache pnpm --filter @diskpush/web build
-
-
-RUN printf '\nPATH=/app/node_modules/.bin:$PATH' >> /root/.profile
-
-
-# start
-COPY . /app
-
-CMD ["pnpm --filter @diskpush/web start"]
-
+# syntax=docker/dockerfile:1
+#
+# diskpush.com on dev2. Hand-written: do NOT regenerate with nixpacks.
+# dev2's compose (cli-tools dev2-site) builds this exact path, so it stays here.
+#
+# The build is unchanged from the nixpacks image: Node 24 + pnpm, installing
+# only @diskpush/web and its deps from pnpm-lock.yaml. The monorepo stays on
+# pnpm because the CLI and desktop releases are built and published with it.
+# Only the runtime moves: Next's standalone server runs under Bun, with no
+# Node in the final image.
+
+FROM node:24-slim AS build
+RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
+  && rm -rf /var/lib/apt/lists/* \
+  && npm install -g pnpm@11.18.0
+WORKDIR /app
+COPY . .
+ENV NEXT_TELEMETRY_DISABLED=1 CI=true
+RUN --mount=type=cache,id=diskpush-pnpm-store,target=/root/.local/share/pnpm/store \
+  pnpm install --frozen-lockfile --prod=false --filter @diskpush/web...
+RUN pnpm --filter @diskpush/web build
+
+FROM oven/bun:1.4.0-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000
+# Docker sets HOSTNAME to the container id, and standalone binds to it literally.
+ENV HOSTNAME=0.0.0.0
+COPY --from=build --chown=bun:bun /app/apps/web/.next/standalone ./
+COPY --from=build --chown=bun:bun /app/apps/web/.next/static ./apps/web/.next/static
+COPY --from=build --chown=bun:bun /app/apps/web/public ./apps/web/public
+USER bun
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD bun -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/').then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))"
+CMD ["bun", "apps/web/server.js"]

apps/web/next.config.mjs

@@ -37,6 +37,12 @@ const securityHeaders = [
 
 const nextConfig = {
   reactStrictMode: true,
+  // The dev2 image runs .next/standalone under Bun (see .nixpacks/Dockerfile).
+  // The tracing root is the repository root, so the server lands at
+  // .next/standalone/apps/web/server.js and the docs/ and scripts/ includes
+  // below land at the same ../../ path the pages read them from.
+  output: 'standalone',
+  outputFileTracingRoot: new URL('../../', import.meta.url).pathname,
   // The docs pages read Markdown from the repository at build time, so the
   // site and the repo can never disagree about what DiskPush does.
   outputFileTracingIncludes: {