Keep .env and local build artifacts out of the Docker image

Without a .dockerignore, COPY . . baked the .env file (including the
webhook secret) into the image and overwrote the container's
node_modules with the host's. Pass public build-time values as build
args and provide the rest at runtime through env_file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,13 @@
+# Installed and built inside the image
+node_modules
+.next
+
+# Secrets are passed in by docker compose, never baked into the image
+.env*
+
+.git
+.github
+Dockerfile
+docker-compose.yml
+*.md
+npm-debug.log*

Dockerfile

@@ -8,6 +8,13 @@ RUN npm install
 
 COPY . .
 
+# NEXT_PUBLIC_* values are inlined at build time, and pages are prerendered
+# with data from Sanity during the build
+ARG NEXT_PUBLIC_SANITY_PROJECT_ID
+ARG NEXT_PUBLIC_SANITY_DATASET
+ARG NEXT_PUBLIC_UMAMI_SRC
+ARG NEXT_PUBLIC_UMAMI_WEBSITE_ID
+
 RUN npm run build
 
 EXPOSE 9000

docker-compose.yml

@@ -1,7 +1,15 @@
 services:
   uiogaming.no:
     container_name: uiogaming.no
-    build: .
+    build:
+      context: .
+      # Values are read from .env
+      args:
+        NEXT_PUBLIC_SANITY_PROJECT_ID: ${NEXT_PUBLIC_SANITY_PROJECT_ID}
+        NEXT_PUBLIC_SANITY_DATASET: ${NEXT_PUBLIC_SANITY_DATASET}
+        NEXT_PUBLIC_UMAMI_SRC: ${NEXT_PUBLIC_UMAMI_SRC}
+        NEXT_PUBLIC_UMAMI_WEBSITE_ID: ${NEXT_PUBLIC_UMAMI_WEBSITE_ID}
+    env_file: .env
     ports:
       - 9000:9000
     environment: