feat(self-host): add Docker SQLite deployment path

Closes #16

Author: vekexasia

.dockerignore

@@ -0,0 +1,10 @@
+**/node_modules
+**/.next
+**/out
+**/.wrangler
+.worktrees
+.self-host
+data
+.git
+.env*
+.tony-menu.local.json

.env.self-host.example

@@ -0,0 +1,16 @@
+PUBLIC_URL=
+ADMIN_USER=admin
+ADMIN_EMAIL=admin@example.com
+ADMIN_EMAILS=admin@example.com
+ADMIN_PASSWORD_HASH=
+ORDER_TIME_ZONE=UTC
+ALLOWED_HOST_SUFFIXES=localhost
+
+LLM_PROVIDER=openai
+LLM_MODEL=gpt-4o-mini
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+DAILY_AI_REQUEST_LIMIT=
+
+CHAT_SESSION_SECRET=change-me
+REFRESH_SECRET=change-me

.pii-allowlist

@@ -148,6 +148,10 @@ test\.local
 (?i)^tony(-chat)?$
 # npm registry tarball URLs in package-lock files are public dependency metadata.
 registry[.]npmjs[.]org
+^https?://([a-z0-9-]+\.)*example(/.*)?$
+^https?://github\.com/sponsors/[a-z0-9-]+$
+^https?://www\.patreon\.com/[a-z0-9-]+$
+^https?://[a-z0-9-]+\.org/support$
 
 # ── Demo restaurant seed data (backend/src/lib/demo-seed-data.ts) ──
 # Placeholder contact details for the public "Trattoria Demo" — all fake.

Caddyfile

@@ -0,0 +1,40 @@
+:80 {
+  @admin path /admin* /api/admin* /api/catalog/publish
+  basicauth @admin {
+    {$ADMIN_USER} {$ADMIN_PASSWORD_HASH}
+  }
+
+  handle /api/admin* {
+    uri strip_prefix /api
+    reverse_proxy backend:8787 {
+      header_up X-Forwarded-Email {$ADMIN_EMAIL}
+      header_up X-Forwarded-Name {$ADMIN_USER}
+    }
+  }
+
+  handle /api/catalog/publish {
+    uri strip_prefix /api
+    reverse_proxy backend:8787 {
+      header_up X-Forwarded-Email {$ADMIN_EMAIL}
+      header_up X-Forwarded-Name {$ADMIN_USER}
+    }
+  }
+
+  handle /api/* {
+    uri strip_prefix /api
+    reverse_proxy backend:8787
+  }
+
+  handle /chat/* {
+    uri strip_prefix /chat
+    reverse_proxy chat:8788
+  }
+
+  handle /assets/* {
+    reverse_proxy backend:8787
+  }
+
+  handle {
+    reverse_proxy web:3000
+  }
+}

Dockerfile

@@ -0,0 +1,25 @@
+FROM node:22-bookworm
+
+WORKDIR /app
+
+COPY package*.json ./
+COPY backend/package*.json backend/
+COPY web/package*.json web/
+COPY packages/schemas/package.json packages/schemas/
+RUN npm ci
+
+COPY web/workers/chat/package*.json web/workers/chat/
+RUN cd web/workers/chat && npm ci
+
+COPY . .
+
+ARG NEXT_PUBLIC_API_URL=/api
+ARG NEXT_PUBLIC_CHAT_WORKER_URL=/chat
+ARG NEXT_PUBLIC_DEFAULT_LOCALE=en
+ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
+    NEXT_PUBLIC_CHAT_WORKER_URL=$NEXT_PUBLIC_CHAT_WORKER_URL \
+    NEXT_PUBLIC_DEFAULT_LOCALE=$NEXT_PUBLIC_DEFAULT_LOCALE
+RUN NEXT_IGNORE_INCORRECT_LOCKFILE=1 npm --workspace web run build
+
+EXPOSE 3000 8787 8788
+CMD ["node", "scripts/serve-static.mjs", "web/out", "3000"]

README.md

@@ -1,6 +1,6 @@
 # TonyMenu
 
-Self-hostable digital restaurant menu, built on Next.js and Cloudflare. Diners scan a QR code, browse a localized menu, and can ask an optional AI assistant for recommendations.
+Self-hostable digital restaurant menu, built on Next.js. Cloudflare is the recommended hosted target; Docker + SQLite is available when you do not want a Cloudflare account. Diners scan a QR code, browse a localized menu, and can ask an optional AI assistant for recommendations.
 
 Restaurant owners manage the menu from `/admin`. QR codes should point to `/`; the app detects the locale and redirects diners to the localized menu.
 
@@ -46,18 +46,29 @@ service, embedding it in a paid product) requires a separate license. See
 
 | Component | What |
 |---|---|
-| `web/` | Next.js 16 (App Router), deployed to Cloudflare Pages |
-| `backend/` | Hono API on Cloudflare Workers, Drizzle ORM over Cloudflare D1 |
-| `web/workers/chat/` | Separate Cloudflare Worker for the AI chat assistant with SSE streaming and tool calls |
+| `web/` | Next.js 16 (App Router), deployed to Cloudflare Pages or static Docker |
+| `backend/` | Hono API on Cloudflare Workers/D1 or Node/SQLite |
+| `web/workers/chat/` | Chat service on Cloudflare Workers or Node, with SSE streaming and tool calls |
 | `packages/schemas/` | Shared Zod schemas (`@menu/schemas`) |
-| Auth | Cloudflare Access with backend JWT verification |
-| Storage | Cloudflare R2 for images and catalog snapshots, Cloudflare KV for the chat menu cache |
+| Auth | Cloudflare Access, or trusted reverse-proxy header in Docker |
+| Storage | R2/KV on Cloudflare, or filesystem uploads + in-memory chat cache in Docker |
 
 ## Self-hosting
 
-Full walkthrough: **[docs/self-hosting.md](docs/self-hosting.md)**.
+- Cloudflare walkthrough: **[docs/self-hosting.md](docs/self-hosting.md)**.
+- No-Cloudflare Docker walkthrough: **[docs/self-hosting-without-cloudflare.md](docs/self-hosting-without-cloudflare.md)**.
 
-Prerequisites: Node 22+, npm 10+, Git, and a Cloudflare account with Zero Trust enabled.
+Cloudflare prerequisites: Node 22+, npm 10+, Git, and a Cloudflare account with Zero Trust enabled.
+
+No-Cloudflare quick start:
+
+```bash
+cp .env.self-host.example .env
+# set ADMIN_PASSWORD_HASH; see docs/self-hosting-without-cloudflare.md
+docker compose up --build
+```
+
+Then open the proxy on port 8080.
 
 Quick local setup:
 ```bash
@@ -147,7 +158,8 @@ admin UI changes that require operator action) live in [CHANGELOG.md](CHANGELOG.
 ## Documentation
 
 - [Changelog](CHANGELOG.md) — per-release notes including upgrade hints
-- [Self-hosting guide](docs/self-hosting.md) — deploy your own copy
+- [Cloudflare self-hosting guide](docs/self-hosting.md) — deploy your own copy on Cloudflare
+- [Docker self-hosting guide](docs/self-hosting-without-cloudflare.md) — deploy without Cloudflare
 - [Secrets & env vars](docs/secrets-and-env-vars.md) — full reference
 - [Architecture & coding conventions](CLAUDE.md)
 - [Contributing](CONTRIBUTING.md)

backend/README.md

@@ -1,6 +1,6 @@
 # TonyMenu backend
 
-Cloudflare Worker REST API for TonyMenu.
+REST API for TonyMenu. Runs on Cloudflare Workers/D1 or the self-host Node + SQLite entrypoint.
 
 ## Stack
 
@@ -25,6 +25,7 @@ Cloudflare Worker REST API for TonyMenu.
 cd backend
 npm install
 npm run dev          # wrangler dev
+npm run start:self-host # Node + SQLite + filesystem bucket
 npm run check        # tsc --noEmit
 npm run test:run     # Vitest
 npm run deploy       # wrangler deploy
@@ -57,6 +58,7 @@ Important bindings/vars:
   routes fall back or return a clear 503 where R2 is required.
 - `R2_PUBLIC_URL` — public base URL for R2 images.
 - `ACCESS_TEAM_DOMAIN`, `ACCESS_AUD` — Cloudflare Access JWT verification.
+- `SELF_HOST_AUTH_HEADER` — trusted reverse-proxy email header for Node self-host.
 - `ALLOWED_ORIGINS` — comma-separated CORS allowlist.
 - `OPENAI_API_KEY` — secret used by translation and OpenAI chat flows.
 

backend/package.json

@@ -5,6 +5,8 @@
   "type": "module",
   "scripts": {
     "dev": "wrangler dev --persist-to .wrangler/state",
+    "dev:self-host": "tsx src/self-host/server.ts",
+    "start:self-host": "tsx src/self-host/server.ts",
     "deploy": "wrangler deploy --var COMMIT_SHA:${COMMIT_SHA:-$(git rev-parse HEAD)} --var ORDER_TIME_ZONE:${ORDER_TIME_ZONE:-$(node -e \"console.log(require('../.tony-menu.local.json').backend.orderTimeZone || 'UTC')\")}",
     "check": "tsc --noEmit",
     "typegen": "wrangler types",
@@ -20,6 +22,7 @@
     "test:migration-sql": "grep -E 'CREATE TYPE|jsonb|timestamp with time|numeric\\(' drizzle/*.sql 2>/dev/null && echo 'FAIL: postgres-isms found' && exit 1 || echo 'PASS: SQLite-only SQL'"
   },
   "dependencies": {
+    "@hono/node-server": "^1.19.14",
     "@menu/schemas": "*",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.9.0",

backend/src/db/index.ts

@@ -1,9 +1,24 @@
-import { drizzle } from 'drizzle-orm/d1';
+import { drizzle as drizzleD1 } from 'drizzle-orm/d1';
+import { drizzle as drizzleSqlite } from 'drizzle-orm/better-sqlite3';
 import type { Env } from '../types';
 
-export function createDb(env: Env) {
-  if (!env.DB) return null;
-  return drizzle(env.DB);
+type D1Db = ReturnType<typeof drizzleD1>;
+
+function withBatch(db: object): D1Db {
+  if ('batch' in db) return db as D1Db;
+  return Object.assign(db, {
+    async batch(queries: unknown[]) {
+      const results: unknown[] = [];
+      for (const query of queries) results.push(await (query as { execute: () => Promise<unknown> }).execute());
+      return results;
+    },
+  }) as D1Db;
+}
+
+export function createDb(env: Env): D1Db | null {
+  if (env.SQLITE_DB) return withBatch(drizzleSqlite(env.SQLITE_DB));
+  if (env.DB) return drizzleD1(env.DB);
+  return null;
 }
 
 export type DbInstance = NonNullable<ReturnType<typeof createDb>>;

backend/src/lib/env.ts

@@ -9,6 +9,7 @@ const envSchema = z.object({
   ORDER_TIME_ZONE: z.string().min(1).default('UTC').refine(isTimeZone, 'Invalid time zone'),
   ACCESS_TEAM_DOMAIN: z.string().min(1).optional(),
   ACCESS_AUD: z.string().min(1).optional(),
+  SELF_HOST_AUTH_HEADER: z.string().min(1).optional(),
 });
 
 function isTimeZone(value: string): boolean {
@@ -29,12 +30,18 @@ export function getRuntimeConfig(env: Env): RuntimeConfig {
     serviceName: parsed.SERVICE_NAME,
     commitSha: parsed.COMMIT_SHA,
     orderTimeZone: parsed.ORDER_TIME_ZONE,
-    databaseMode: env.DB ? 'd1' : 'unconfigured',
+    databaseMode: env.SQLITE_DB ? 'sqlite' : env.DB ? 'd1' : 'unconfigured',
     hasPublicMenuBucket: Boolean(env.PUBLIC_MENU_BUCKET),
     auth: {
       issuer: parsed.ACCESS_TEAM_DOMAIN,
       audience: parsed.ACCESS_AUD,
-      configured: Boolean(parsed.ACCESS_TEAM_DOMAIN && parsed.ACCESS_AUD),
+      trustedHeader: parsed.SELF_HOST_AUTH_HEADER,
+      mode: parsed.ACCESS_TEAM_DOMAIN && parsed.ACCESS_AUD
+        ? 'cloudflare-access'
+        : parsed.SELF_HOST_AUTH_HEADER
+          ? 'trusted-header'
+          : 'unconfigured',
+      configured: Boolean((parsed.ACCESS_TEAM_DOMAIN && parsed.ACCESS_AUD) || parsed.SELF_HOST_AUTH_HEADER),
     },
   };
 }