[Snyk] Upgrade pg from 8.11.3 to 8.14.1

.dockerignore

@@ -0,0 +1,37 @@
+# Version control
+.git
+.gitignore
+.gitattributes
+
+# Dependencies
+node_modules
+npm-debug.log
+yarn-debug.log
+yarn-error.log
+
+# Environment
+.env
+.env.*
+
+# Development
+.vscode
+.idea
+*.md
+test
+coverage
+.prettierrc
+jest.config.js
+
+# Build
+dist
+build
+
+# Docker
+Dockerfile
+.dockerignore
+
+# Misc
+.DS_Store
+*.log
+*.swp
+*.bak

.env.test

@@ -2,4 +2,9 @@ POSTGRESQL_URL=postgres://root:password@192.168.1.120:8333/postgres
 MONGO_URL=mongodb://admin:123456@192.168.1.120:27017/db?authSource=admin
 JWT_SECRET=secret
 SESSION_EXPIRES_IN=1h
-INITIAL_ADMIN_PASSWORD=123456
+INITIAL_ADMIN_PASSWORD=123456
+PORT=6701
+DADATA_API_TOKEN=
+GOOGLE_MAPS_API_KEY=
+REDIS_URL=redis://localhost:6379
+DEV_SECRET_KEY=123456

.eslintrc.js

@@ -34,7 +34,7 @@ module.exports = {
         ],
         "newlines-between": "always",
         alphabetize: {
-          order: "asc" /* asc или desc */,
+          order: "asc",
           caseInsensitive: true,
         },
       },
@@ -51,5 +51,36 @@ module.exports = {
     "import/first": "error",
     "import/newline-after-import": "error",
     "import/no-duplicates": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        paths: [
+          {
+            name: "class-validator",
+            message:
+              "Import custom validators from @i18n-class-validator instead",
+          },
+        ],
+        patterns: [
+          {
+            group: ["class-validator/*"],
+            message:
+              "Import custom validators from @i18n-class-validator instead",
+          },
+        ],
+      },
+    ],
+    "import/no-restricted-paths": [
+      "error",
+      {
+        zones: [
+          {
+            target: "./src/**/*",
+            from: "class-validator",
+            except: ["./src/i18n/validators/index.ts"],
+          },
+        ],
+      },
+    ],
   },
 };

.example.env

@@ -1,4 +1,11 @@
 POSTGRESQL_URL=postgres://root:password@164.92.197.53:8333/testdb
 JWT_SECRET=secret
 SESSION_EXPIRES_IN=1s
-INITIAL_ADMIN_PASSWORD=123456
+INITIAL_ADMIN_PASSWORD=123456
+PORT=6701
+DADATA_API_TOKEN=
+GOOGLE_MAPS_API_KEY=
+REDIS_URL=
+API_SECRET_KEY=
+DEV_SECRET_KEY=
+COOKIES_SECRET=

.vscode/settings.json

@@ -1,10 +1,14 @@
 {
-    "javascript.updateImportsOnFileMove.enabled": "always",
-    "typescript.updateImportsOnFileMove.enabled": "always",
-    "editor.codeActionsOnSave": {
-      "source.fixAll.eslint": "explicit"
-    },
-    "editor.formatOnSave": true,
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "npm.packageManager": "yarn"
-  }
+  "javascript.updateImportsOnFileMove.enabled": "always",
+  "typescript.updateImportsOnFileMove.enabled": "always",
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+  "editor.formatOnSave": true,
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "npm.packageManager": "yarn",
+  "workbench.colorCustomizations": {
+    "minimap.background": "#00000000",
+    "scrollbar.shadow": "#00000000"
+  }
+}

Dockerfile

@@ -0,0 +1,60 @@
+# Build stage
+FROM node:22-alpine AS builder
+
+WORKDIR /app
+
+# Install python and build dependencies
+RUN apk add --no-cache python3 make g++
+
+COPY package.json yarn.lock ./
+
+# Install dependencies
+RUN yarn install --frozen-lockfile
+
+COPY . .
+
+# Build the application
+RUN yarn build
+
+# Production stage
+FROM node:22-alpine AS production
+
+WORKDIR /app
+
+# Install python and build dependencies for production packages that need compilation
+RUN apk add --no-cache python3 make g++
+
+COPY package.json yarn.lock ./
+
+# Install only production dependencies
+RUN yarn install --frozen-lockfile --production
+
+FROM node:22-alpine AS runner
+WORKDIR /app
+
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nestjs
+
+COPY --from=production /app/node_modules ./node_modules
+
+RUN mkdir dist
+
+RUN chown nestjs:nodejs dist
+RUN chown nestjs:nodejs node_modules
+
+# Copy built assets from builder stage
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/src/i18n ./src/i18n
+COPY --from=builder /app/src/i18n/messages ./dist/i18n/messages
+
+# Set environment variables
+ENV NODE_ENV=production
+ENV PORT=3000
+
+# Expose the port the app runs on
+EXPOSE ${PORT}
+
+USER nestjs
+
+# Start the application
+CMD ["node", "dist/src/main.js"]

deployment/.example.env

@@ -0,0 +1,25 @@
+DOMAIN=demo.toite.ee
+
+# Docker images
+BACKEND_REPO_IMAGE=yefro/toite-backend:latest
+FRONTEND_REPO_IMAGE=yefro/toite-frontend:latest
+
+# Secrets
+# openssl rand -base64 32
+JWT_SECRET=
+CSRF_SECRET=
+COOKIES_SECRET=
+INITIAL_ADMIN_PASSWORD=
+REDIS_PASSWORD=
+POSTGRES_PASSWORD=
+MONGO_PASSWORD=
+
+# S3
+S3_ACCESS_KEY_ID=
+S3_SECRET_ACCESS_KEY=
+S3_BUCKET_NAME=
+S3_ENDPOINT=
+
+# Api keys
+DADATA_API_TOKEN=
+GOOGLE_MAPS_API_KEY=

deployment/docker-compose.yml

@@ -0,0 +1,162 @@
+version: "3.9"
+name: "toite"
+
+services:
+  traefik:
+    container_name: traefik
+    image: traefik:v3.3
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/tcp" # HTTP/3
+      - "443:443/udp" # HTTP/3
+      - "8080:8080"
+    networks:
+      toite-network:
+        ipv4_address: 172.36.0.2
+    volumes:
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - "./traefik.yml:/etc/traefik/traefik.yml:ro" # Static configuration
+      - "traefik-data:/data" # Certificates and etc
+    labels:
+      - "traefik.enable=true"
+      # Global redirection to https
+      - "traefik.http.routers.http-catchall.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.http-catchall.entrypoints=web"
+      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
+      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
+
+  # Running mongo database
+  mongo:
+    container_name: mongo
+    build:
+      context: mongo
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: toite
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD}
+    ports:
+      - "27017:27017"
+    networks:
+      toite-network:
+        ipv4_address: 172.36.0.3
+    volumes:
+      - "mongo-data:/data/db"
+
+  # Running simple postgres database
+  postgres:
+    container_name: postgres
+    image: postgres
+    restart: unless-stopped
+    environment:
+      PGDATA: /data/postgres
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    ports:
+      - "5432:5432"
+    networks:
+      toite-network:
+        ipv4_address: 172.36.0.4
+    volumes:
+      - "postgres-data:/data/postgres"
+
+  # Running redis cache
+  redis:
+    container_name: redis
+    image: redis:6.2-alpine
+    command: redis-server --save 20 1 --loglevel warning --requirepass "${REDIS_PASSWORD}"
+    restart: unless-stopped
+    ports:
+      - "6379:6379"
+    networks:
+      toite-network:
+        ipv4_address: 172.36.0.5
+    volumes:
+      - "redis-data:/data"
+
+  backend:
+    container_name: toite-backend
+    image: ${BACKEND_REPO_IMAGE:-yefro/toite-backend:latest}
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      PORT: 5000
+      MONGO_URL: mongodb://toite:${MONGO_PASSWORD}@172.36.0.3:27017/toite?authSource=admin&directConnection=true
+      POSTGRESQL_URL: postgres://postgres:${POSTGRES_PASSWORD}@172.36.0.4:5432/postgres
+      JWT_SECRET: ${JWT_SECRET}
+      CSRF_SECRET: ${CSRF_SECRET}
+      SESSION_EXPIRES_IN: 4h
+      INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD}
+      DADATA_API_TOKEN: ${DADATA_API_TOKEN}
+      GOOGLE_MAPS_API_KEY: ${GOOGLE_MAPS_API_KEY}
+      REDIS_URL: redis://:${REDIS_PASSWORD}@172.36.0.5:6379
+      COOKIES_SECRET: ${COOKIES_SECRET}
+      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
+      S3_BUCKET_NAME: ${S3_BUCKET_NAME}
+      S3_ENDPOINT: ${S3_ENDPOINT}
+      S3_REGION: ${S3_REGION}
+    ports:
+      - "5000:5000"
+    networks:
+      toite-network:
+        ipv4_address: 172.36.0.10
+    depends_on:
+      - redis
+      - postgres
+      - mongo
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.backend.rule=Host(`${DOMAIN}`) && (PathPrefix(`/api`) || PathPrefix(`/socket.io`))"
+      - "traefik.http.routers.backend.entrypoints=websecure"
+      - "traefik.http.routers.backend.tls.certresolver=letsencrypt"
+      - "traefik.http.services.backend.loadbalancer.server.port=5000"
+      - "traefik.http.routers.backend.middlewares=strip-api" # Apply the middleware
+
+      # Define the middleware to strip the /api prefix
+      - "traefik.http.middlewares.strip-api.stripprefix.prefixes=/api"
+
+  frontend:
+    container_name: toite-frontend
+    image: ${FRONTEND_REPO_IMAGE:-yefro/toite-frontend:latest}
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      NEXT_INTERNAL_API_URL: http://172.36.0.10
+    ports:
+      - "3000:3000"
+    networks:
+      toite-network:
+        ipv4_address: 172.36.0.11
+    depends_on:
+      - backend
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.frontend.rule=Host(`${DOMAIN}`)"
+      - "traefik.http.routers.frontend.entrypoints=websecure"
+      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
+      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
+
+volumes:
+  # SSL and etc.
+  traefik-data:
+    driver: local
+  # Mongo data storage
+  mongo-data:
+    driver: local
+  # Postgres data storage
+  postgres-data:
+    driver: local
+  # Redis data storage
+  redis-data:
+    driver: local
+
+networks:
+  # Shared network
+  toite-network:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.36.0.0/16
+          gateway: 172.36.0.1