ThreadCount Community edition
Uniform stock management for healthcare linen rooms: the coordinator app, the phone counter and the staff app, for your own server. Built from a113353 on 2026-09-15. Licensed under the Functional Source License (FSL-1.1-ALv2).
This commit is contained in:
ThreadCount
@@ -0,0 +1,98 @@
|
||||
import type { NextConfig } from "next";
|
||||
import { HOSTED_TELEMETRY_HOSTS } from "./lib/hosted-defaults";
|
||||
|
||||
// The telemetry hosts the policy admits: the hosted service's own, or none in the Community
|
||||
// edition (whose lib/hosted-defaults.ts is blank), plus whatever an operator set explicitly.
|
||||
const telemetry = [...HOSTED_TELEMETRY_HOSTS, ...[process.env.NEXT_PUBLIC_UMAMI_SRC, process.env.NEXT_PUBLIC_GLITCHTIP_DSN].map((u) => { try { return u ? new URL(u).origin : ""; } catch { return ""; } })].filter(Boolean);
|
||||
const scriptHosts = ["https://challenges.cloudflare.com", ...telemetry].join(" ");
|
||||
const connectHosts = ["'self'", ...telemetry].join(" ");
|
||||
// The helpdesk chat widget (Chatwoot) — only when an operator points at one; the Community
|
||||
// edition ships without. Its SDK, iframe, avatars and websocket all come from that one origin.
|
||||
const helpdesk = (() => { try { return process.env.NEXT_PUBLIC_CHATWOOT_URL ? new URL(process.env.NEXT_PUBLIC_CHATWOOT_URL).origin : ""; } catch { return ""; } })();
|
||||
const helpdeskWs = helpdesk ? " " + helpdesk + " " + helpdesk.replace(/^https:/, "wss:") : "";
|
||||
// Stripe's Payment Element (the on-site checkout) — its script, its iframes and its API — only on
|
||||
// an instance that takes cards. Everything Stripe needs comes from these three hosts.
|
||||
const cards = !!process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY;
|
||||
const stripeScript = cards ? " https://js.stripe.com" : "";
|
||||
const stripeFrames = cards ? " https://js.stripe.com https://hooks.stripe.com" : "";
|
||||
const stripeConnect = cards ? " https://api.stripe.com" : "";
|
||||
|
||||
// Security headers. Inline styles/scripts are part of how Next hydrates and how the print windows are
|
||||
// built, so CSP allows 'unsafe-inline' for those while still pinning every origin to self.
|
||||
const csp = [
|
||||
"default-src 'self'",
|
||||
// Cloudflare Insights is not used and never was — the entries were permissive leftovers.
|
||||
`script-src 'self' 'unsafe-inline' ${scriptHosts}${helpdesk ? " " + helpdesk : ""}${stripeScript}`,
|
||||
`frame-src https://challenges.cloudflare.com${helpdesk ? " " + helpdesk : ""}${stripeFrames}`,
|
||||
"style-src 'self' 'unsafe-inline'",
|
||||
`img-src 'self' data: blob:${helpdesk ? " " + helpdesk : ""}`,
|
||||
"media-src 'self' blob:",
|
||||
"font-src 'self' data:",
|
||||
`connect-src ${connectHosts}${helpdeskWs}${stripeConnect}`,
|
||||
"worker-src 'self' blob:",
|
||||
"frame-ancestors 'none'",
|
||||
"base-uri 'self'",
|
||||
"form-action 'self'",
|
||||
"object-src 'none'",
|
||||
].join("; ");
|
||||
|
||||
const headers = [
|
||||
{ key: "Content-Security-Policy", value: csp },
|
||||
{ key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },
|
||||
{ key: "X-Content-Type-Options", value: "nosniff" },
|
||||
{ key: "X-Frame-Options", value: "DENY" },
|
||||
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
||||
{ key: "Permissions-Policy", value: "camera=(self), microphone=(), geolocation=(), payment=()" },
|
||||
];
|
||||
|
||||
const nextConfig: NextConfig = {
|
||||
poweredByHeader: false,
|
||||
// The Docker image (Community edition) runs Next's standalone server; the hosted box runs
|
||||
// `next start` from the full build, which standalone output would warn about. Opt in per build.
|
||||
...(process.env.NEXT_OUTPUT === "standalone" ? { output: "standalone" as const } : {}),
|
||||
// The deploy builds into a SEPARATE directory (NEXT_DIST_DIR=.next-build) and swaps it in with
|
||||
// two renames before the restart, so the running server keeps serving a complete .next for the
|
||||
// whole build window. Runtime (`next start`) leaves this unset and reads ".next".
|
||||
distDir: process.env.NEXT_DIST_DIR || ".next",
|
||||
// Browser source maps are built so a deploy can upload them to the error tracker against the
|
||||
// release, then delete them from .next/static before the site restarts — they are never served. Symbolicated client stacks in GlitchTip without pulling an SDK into the bundle.
|
||||
productionBrowserSourceMaps: true,
|
||||
// The manual is Markdown read from docs/manual at request time inside the app (/app/help is
|
||||
// rendered per request, behind a session). The standalone server the Community image runs only
|
||||
// carries files the tracer can see, and a path built at runtime is invisible to it, so the folder
|
||||
// is named here. The website's /docs pages are prerendered and need nothing.
|
||||
outputFileTracingIncludes: {
|
||||
"/app/help": ["./docs/manual/**/*.md"],
|
||||
"/app/help/**": ["./docs/manual/**/*.md"],
|
||||
},
|
||||
async headers() {
|
||||
return [{ source: "/(.*)", headers }];
|
||||
},
|
||||
// The site went from twenty-three pages to nine on 2026-09-15. Every old address still lands
|
||||
// somewhere useful, permanently, so nothing indexed, linked from an email or printed on a slip
|
||||
// breaks. /product and /reports were older redirects again (to /features and /reporting);
|
||||
// they now go straight to where those pages ended up.
|
||||
async redirects() {
|
||||
return [
|
||||
{ source: "/features", destination: "/product", permanent: true },
|
||||
{ source: "/how-it-works", destination: "/product#flow", permanent: true },
|
||||
{ source: "/reporting", destination: "/product#reports", permanent: true },
|
||||
{ source: "/reports", destination: "/product#reports", permanent: true },
|
||||
{ source: "/faq", destination: "/product#questions", permanent: true },
|
||||
{ source: "/getting-started", destination: "/docs/start/set-up-in-an-afternoon", permanent: true },
|
||||
{ source: "/guides", destination: "/docs#guides", permanent: true },
|
||||
{ source: "/roadmap", destination: "/changelog#next", permanent: true },
|
||||
{ source: "/contact", destination: "/about#contact", permanent: true },
|
||||
{ source: "/legal-about", destination: "/about", permanent: true },
|
||||
// The coordinator portal's screens folded into seven on the 2026-09 overhaul. Temporary (307)
|
||||
// redirects; the incoming query string is merged into the destination.
|
||||
{ source: "/app/issue", destination: "/app/counter", permanent: false },
|
||||
{ source: "/app/stocktake", destination: "/app/stock?tab=count", permanent: false },
|
||||
{ source: "/app/orders/list", destination: "/app/orders", permanent: false },
|
||||
{ source: "/app/activity", destination: "/app/settings?tab=audit", permanent: false },
|
||||
{ source: "/app/dashboard", destination: "/app", permanent: false },
|
||||
];
|
||||
},
|
||||
};
|
||||
|
||||
export default nextConfig;
|
||||
Reference in New Issue
Block a user