From e263a9414febc588a6d2e1021d114431222300fc Mon Sep 17 00:00:00 2001
From: Mudit Lal <mudit@devalok.in>
Date: Wed, 19 Aug 2026 23:07:09 +0530
Subject: [PATCH] fix(docker): set NODE_ENV=production in the runner stage

Upstream's Dockerfile never sets NODE_ENV, and nothing in docker/ sets it
either, so every self-hosted instance runs with it unset. Two consequences
on sign.devalok.in:

  - `useSecureCookies` in packages/lib/constants/auth.ts requires
    NODE_ENV === 'production', so it evaluated false: session cookies were
    issued without the Secure flag and without the __Secure- name prefix,
    and sameSite fell back to 'lax' instead of 'none'.
  - react-router resolved its *development* bundle at runtime (visible as
    react-router/dist/development/... in stack traces) -- slower, more
    memory, verbose errors surfaced to clients.

Set in the runner stage only, deliberately. Setting NODE_ENV as a Railway
service variable would also apply during the build, where `npm ci` in the
installer stage would omit devDependencies and break `turbo run build`
immediately after. The runner stage already installs with
`npm ci --only=production`, so nothing there needs dev deps.

Side effect: the session cookie name changes from `sessionId` to
`__Secure-sessionId`, so existing sessions are invalidated once on deploy.

DEVALOK_FORK_NOTES.md gains a "Fork-local code changes" table and adds
docker/Dockerfile to the fork-delta capture, so the next read-tree upstream
import doesn't silently drop this line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DYNE3dT1E7bGHk8Y8joXMm
---
 DEVALOK_FORK_NOTES.md | 14 ++++++++++++--
 docker/Dockerfile     |  8 ++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/DEVALOK_FORK_NOTES.md b/DEVALOK_FORK_NOTES.md
index 5e309da0..0191c1cb 100644
--- a/DEVALOK_FORK_NOTES.md
+++ b/DEVALOK_FORK_NOTES.md
@@ -28,8 +28,9 @@ git remote add upstream https://github.com/documenso/documenso.git   # one-time
 git fetch upstream
 git checkout -b chore/upstream-merge-<yymm>
 
-# fork-only delta = workflow guards + this file. Capture it against the PREVIOUS sync base.
-git diff <previous-sync-base> HEAD -- .github/workflows DEVALOK_FORK_NOTES.md > ../fork-delta.patch
+# fork-only delta = workflow guards + this file + the Dockerfile NODE_ENV line.
+# Capture it against the PREVIOUS sync base.
+git diff <previous-sync-base> HEAD -- .github/workflows DEVALOK_FORK_NOTES.md docker/Dockerfile > ../fork-delta.patch
 
 # working tree becomes upstream/main exactly (adds, mods AND deletes)
 git read-tree -u --reset upstream/main
@@ -105,6 +106,15 @@ Expected open (intentional): `ci.yml/build_docker`, `codeql-analysis.yml/analyze
 - `ci.yml` — only the `build_docker` job (Docker build = real prod signal). `build_app` job guarded above.
 - `codeql-analysis.yml` — security scan (uses only `GITHUB_TOKEN`)
 
+## Fork-local code changes
+
+Keep this list short — every entry is a merge conflict waiting to happen. Anything here MUST be in the
+`fork-delta.patch` capture above, or the next `read-tree` import silently drops it.
+
+| File | Change | Why |
+|---|---|---|
+| `docker/Dockerfile` | `ENV NODE_ENV="production"` in the **runner** stage | Upstream never sets `NODE_ENV`, so self-hosters run React Router's *development* bundle and `useSecureCookies` (`packages/lib/constants/auth.ts`) stays false — session cookies get no `Secure` flag and no `__Secure-` prefix. **Must be runner-stage only**: as a Railway service variable it also reaches the build, where `npm ci` (installer stage) would omit devDependencies and break `turbo run build`. Worth upstreaming; until then it lives here. |
+
 ## Railway deploy
 
 - Project: `documenso` (`9c5f62f8-2820-4ae0-862f-7c39db14e3f6`)
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 0b5923a0..2b5afe2f 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -96,6 +96,14 @@ FROM base AS runner
 ENV HUSKY 0
 ENV DOCKER_OUTPUT 1
 
+# Devalok fork-local: upstream never sets NODE_ENV, so self-hosted instances run
+# React Router's development bundle and `useSecureCookies` in
+# packages/lib/constants/auth.ts stays false -- session cookies ship without the
+# Secure flag and without the __Secure- prefix. Set here in the RUNNER stage only:
+# as a build-time variable it would make `npm ci` (installer stage) omit
+# devDependencies and break `turbo run build`.
+ENV NODE_ENV="production"
+
 # Telemetry credentials (baked into image at build time, can be disabled at runtime)
 ARG NEXT_PRIVATE_TELEMETRY_KEY=""
 ENV NEXT_PRIVATE_TELEMETRY_KEY="$NEXT_PRIVATE_TELEMETRY_KEY"