[codex] cap server proxy upload cap

.dockerignore

@@ -2,3 +2,5 @@ target
 crates
 **/node_modules
 **/.next
+!apps/web/.next
+!apps/web/.next/**

.railwayignore

@@ -0,0 +1,39 @@
+.git
+.claude
+.config
+.cursor
+.docs
+.growth-agent
+.next
+.opencode
+.sst
+.tinyb
+.turbo
+.vercel
+.vinxi
+.vscode
+.zed
+analysis
+crates
+logs
+node_modules
+outputs
+target
+target-agent
+target-phase8
+tmp
+**/.next
+**/.tinyb
+**/node_modules
+**/target
+apps/storybook/storybook-static
+apps/web/.next
+apps/web/playwright-report
+apps/web/test-results
+native-deps*
+*.local
+*.log
+*.tsbuildinfo
+.DS_Store
+.env
+.env.*

apps/cloudflare-web/Dockerfile

@@ -0,0 +1,23 @@
+FROM node:24-bookworm-slim AS node
+
+FROM mysql:8.4 AS runner
+WORKDIR /app
+
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+
+COPY apps/web/.next/standalone ./
+COPY apps/web/.next/static ./apps/web/.next/static
+COPY apps/web/public ./apps/web/public
+COPY packages/database/migrations ./apps/web/migrations
+COPY packages/database/migrations ./migrations
+COPY apps/cloudflare-web/start.sh ./start.sh
+
+RUN chmod +x ./start.sh
+
+ENV PORT=8080
+ENV HOSTNAME=0.0.0.0
+
+EXPOSE 8080
+
+CMD ["./start.sh"]

apps/cloudflare-web/package.json

@@ -0,0 +1,17 @@
+{
+	"name": "@cap/cloudflare-web",
+	"private": true,
+	"type": "module",
+	"scripts": {
+		"deploy:web": "wrangler deploy -c ../../wrangler.cap-web.jsonc",
+		"deploy:media": "wrangler deploy -c ../../wrangler.cap-media.jsonc",
+		"containers:list": "wrangler containers list -c ../../wrangler.cap-web.jsonc",
+		"containers:images": "wrangler containers images list -c ../../wrangler.cap-web.jsonc"
+	},
+	"dependencies": {
+		"@cloudflare/containers": "^0.3.3"
+	},
+	"devDependencies": {
+		"wrangler": "^4.90.0"
+	}
+}

apps/cloudflare-web/src/media.ts

@@ -0,0 +1,35 @@
+import { Container } from "@cloudflare/containers";
+
+interface Env {
+	CAP_MEDIA: DurableObjectNamespace<CapMediaContainer>;
+	MEDIA_SERVER_WEBHOOK_SECRET?: string;
+}
+
+export class CapMediaContainer extends Container<Env> {
+	defaultPort = 3456;
+	sleepAfter = "2m";
+	enableInternet = true;
+
+	constructor(ctx: DurableObjectState, env: Env) {
+		super(ctx, env);
+		this.envVars = {
+			MEDIA_SERVER_WEBHOOK_SECRET: env.MEDIA_SERVER_WEBHOOK_SECRET ?? "",
+			PORT: "3456",
+		};
+	}
+}
+
+export default {
+	async fetch(request: Request, env: Env): Promise<Response> {
+		const url = new URL(request.url);
+
+		if (url.pathname === "/cf-health") {
+			return new Response("OK");
+		}
+
+		const id = env.CAP_MEDIA.idFromName("media");
+		const container = env.CAP_MEDIA.get(id);
+
+		return container.fetch(request);
+	},
+};

apps/cloudflare-web/src/web.ts

@@ -0,0 +1,162 @@
+import { Container } from "@cloudflare/containers";
+
+interface Env {
+	CAP_WEB: DurableObjectNamespace<CapWebContainer>;
+	CAP_AWS_ACCESS_KEY?: string;
+	CAP_AWS_BUCKET?: string;
+	CAP_AWS_REGION?: string;
+	CAP_AWS_SECRET_KEY?: string;
+	CAP_STORAGE_LIMIT_BYTES?: string;
+	CAP_VIDEOS_DEFAULT_PUBLIC?: string;
+	CLOUDFLARE_EMAIL_FROM_DOMAIN?: string;
+	CLOUDFLARE_EMAIL_SECRET?: string;
+	CLOUDFLARE_EMAIL_WORKER_URL?: string;
+	CRON_SECRET?: string;
+	DATABASE_ENCRYPTION_KEY?: string;
+	EMAIL: {
+		send(message: {
+			cc?: string | string[];
+			from: string | { email: string; name: string };
+			html?: string;
+			replyTo?: string;
+			subject: string;
+			text?: string;
+			to: string | string[];
+		}): Promise<{ messageId: string }>;
+	};
+	MEDIA_SERVER_URL?: string;
+	MEDIA_SERVER_WEBHOOK_SECRET?: string;
+	MEDIA_SERVER_WEBHOOK_URL?: string;
+	NEXTAUTH_SECRET?: string;
+	NEXTAUTH_URL?: string;
+	NEXT_PUBLIC_WEB_URL?: string;
+	NODE_ENV?: string;
+	S3_INTERNAL_ENDPOINT?: string;
+	S3_PATH_STYLE?: string;
+	S3_PUBLIC_ENDPOINT?: string;
+	WEB_URL?: string;
+	WORKFLOWS_RPC_SECRET?: string;
+}
+
+const copiedKeys = [
+	"CAP_AWS_ACCESS_KEY",
+	"CAP_AWS_BUCKET",
+	"CAP_AWS_REGION",
+	"CAP_AWS_SECRET_KEY",
+	"CAP_STORAGE_LIMIT_BYTES",
+	"CAP_VIDEOS_DEFAULT_PUBLIC",
+	"CLOUDFLARE_EMAIL_FROM_DOMAIN",
+	"CLOUDFLARE_EMAIL_SECRET",
+	"CLOUDFLARE_EMAIL_WORKER_URL",
+	"CRON_SECRET",
+	"DATABASE_ENCRYPTION_KEY",
+	"MEDIA_SERVER_URL",
+	"MEDIA_SERVER_WEBHOOK_SECRET",
+	"MEDIA_SERVER_WEBHOOK_URL",
+	"NEXTAUTH_SECRET",
+	"NEXTAUTH_URL",
+	"NEXT_PUBLIC_WEB_URL",
+	"NODE_ENV",
+	"S3_INTERNAL_ENDPOINT",
+	"S3_PATH_STYLE",
+	"S3_PUBLIC_ENDPOINT",
+	"WEB_URL",
+	"WORKFLOWS_RPC_SECRET",
+] as const;
+
+function buildEnv(env: Env): Record<string, string> {
+	const vars: Record<string, string> = {
+		DATABASE_URL: "mysql://cap:cap-local-pwd@127.0.0.1:3306/cap",
+		HOSTNAME: "0.0.0.0",
+		MYSQL_DATABASE: "cap",
+		MYSQL_PASSWORD: "cap-local-pwd",
+		MYSQL_USER: "cap",
+		CLOUDFLARE_EMAIL_FROM_DOMAIN:
+			env.CLOUDFLARE_EMAIL_FROM_DOMAIN ?? "shashanksn.xyz",
+		CLOUDFLARE_EMAIL_WORKER_URL:
+			env.CLOUDFLARE_EMAIL_WORKER_URL ??
+			"https://video.shashanksn.xyz/cf-email/send",
+		NEXT_PUBLIC_DOCKER_BUILD: "true",
+		NEXT_PUBLIC_WEB_URL:
+			env.NEXT_PUBLIC_WEB_URL ?? "https://video.shashanksn.xyz",
+		NEXTAUTH_URL: env.NEXTAUTH_URL ?? "https://video.shashanksn.xyz",
+		NODE_ENV: env.NODE_ENV ?? "production",
+		PORT: "8080",
+		WEB_URL: env.WEB_URL ?? "https://video.shashanksn.xyz",
+	};
+
+	for (const key of copiedKeys) {
+		const value = env[key];
+
+		if (typeof value === "string" && value.length > 0) {
+			vars[key] = value;
+		}
+	}
+
+	return vars;
+}
+
+export class CapWebContainer extends Container<Env> {
+	defaultPort = 8080;
+	sleepAfter = "2m";
+	enableInternet = true;
+
+	constructor(ctx: DurableObjectState, env: Env) {
+		super(ctx, env);
+		this.envVars = buildEnv(env);
+	}
+}
+
+export default {
+	async fetch(request: Request, env: Env): Promise<Response> {
+		const url = new URL(request.url);
+
+		if (url.pathname === "/cf-health") {
+			return new Response("OK");
+		}
+
+		if (url.pathname === "/cf-email/send") {
+			const token = request.headers
+				.get("authorization")
+				?.replace("Bearer ", "");
+
+			if (
+				!env.CLOUDFLARE_EMAIL_SECRET ||
+				token !== env.CLOUDFLARE_EMAIL_SECRET
+			) {
+				return new Response("Unauthorized", { status: 401 });
+			}
+
+			const message = (await request.json()) as {
+				cc?: string | string[];
+				from: string | { email: string; name: string };
+				html?: string;
+				replyTo?: string;
+				subject?: string;
+				text?: string;
+				to?: string | string[];
+			};
+
+			if (!message.to || !message.from || !message.subject) {
+				return new Response("Missing required email fields", { status: 400 });
+			}
+
+			const result = await env.EMAIL.send({
+				cc: message.cc,
+				from: message.from,
+				html: message.html,
+				replyTo: message.replyTo,
+				subject: message.subject,
+				text: message.text,
+				to: message.to,
+			});
+
+			return Response.json(result);
+		}
+
+		const id = env.CAP_WEB.idFromName("web");
+		const container = env.CAP_WEB.get(id);
+
+		return container.fetch(request);
+	},
+};

apps/cloudflare-web/start.sh

@@ -0,0 +1,49 @@
+#!/bin/sh
+set -eu
+
+export MYSQL_DATABASE="${MYSQL_DATABASE:-cap}"
+export MYSQL_USER="${MYSQL_USER:-cap}"
+export MYSQL_PASSWORD="${MYSQL_PASSWORD:-cap-local-pwd}"
+export MYSQL_DATADIR="${MYSQL_DATADIR:-/tmp/mysql-data}"
+export MYSQL_SOCKET="${MYSQL_SOCKET:-/tmp/mysql.sock}"
+export MYSQL_PORT="${MYSQL_PORT:-3306}"
+export DATABASE_URL="${DATABASE_URL:-mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@127.0.0.1:${MYSQL_PORT}/${MYSQL_DATABASE}}"
+export HOSTNAME="${HOSTNAME:-0.0.0.0}"
+export PORT="${PORT:-8080}"
+
+mkdir -p "$MYSQL_DATADIR" /run/mysqld
+chown -R mysql:mysql "$MYSQL_DATADIR" /run/mysqld
+
+if [ ! -d "$MYSQL_DATADIR/mysql" ]; then
+	mysqld --initialize-insecure --datadir="$MYSQL_DATADIR" --user=mysql >/tmp/mysql-install.log 2>&1
+fi
+
+mysqld --datadir="$MYSQL_DATADIR" --socket="$MYSQL_SOCKET" --pid-file=/tmp/mysql.pid --bind-address=127.0.0.1 --port="$MYSQL_PORT" --user=mysql &
+MYSQL_PID="$!"
+
+cleanup() {
+	kill "$MYSQL_PID" 2>/dev/null || true
+	wait "$MYSQL_PID" 2>/dev/null || true
+}
+
+trap cleanup INT TERM EXIT
+
+for _ in $(seq 1 60); do
+	if mysqladmin --socket="$MYSQL_SOCKET" ping >/dev/null 2>&1; then
+		break
+	fi
+	sleep 1
+done
+
+mysql --socket="$MYSQL_SOCKET" -uroot <<SQL
+CREATE DATABASE IF NOT EXISTS \`${MYSQL_DATABASE}\`;
+CREATE USER IF NOT EXISTS '${MYSQL_USER}'@'%' IDENTIFIED BY '${MYSQL_PASSWORD}';
+CREATE USER IF NOT EXISTS '${MYSQL_USER}'@'localhost' IDENTIFIED BY '${MYSQL_PASSWORD}';
+CREATE USER IF NOT EXISTS '${MYSQL_USER}'@'127.0.0.1' IDENTIFIED BY '${MYSQL_PASSWORD}';
+GRANT ALL PRIVILEGES ON \`${MYSQL_DATABASE}\`.* TO '${MYSQL_USER}'@'%';
+GRANT ALL PRIVILEGES ON \`${MYSQL_DATABASE}\`.* TO '${MYSQL_USER}'@'localhost';
+GRANT ALL PRIVILEGES ON \`${MYSQL_DATABASE}\`.* TO '${MYSQL_USER}'@'127.0.0.1';
+FLUSH PRIVILEGES;
+SQL
+
+exec node apps/web/server.js

apps/cloudflared/Dockerfile

@@ -0,0 +1,3 @@
+FROM cloudflare/cloudflared:2026.3.0
+
+CMD ["tunnel", "--no-autoupdate", "run"]

apps/expiry-cleaner/Dockerfile

@@ -0,0 +1,3 @@
+FROM curlimages/curl:8.11.1
+
+CMD ["sh", "-c", "curl -fsS -H \"Authorization: Bearer ${CRON_SECRET}\" \"${CAP_WEB_URL:-https://video.shashanksn.xyz}/api/cron/expired-videos\""]

apps/expiry-cleaner/railway.json

@@ -0,0 +1,10 @@
+{
+	"$schema": "https://railway.com/railway.schema.json",
+	"build": {
+		"dockerfilePath": "Dockerfile"
+	},
+	"deploy": {
+		"cronSchedule": "0 */6 * * *",
+		"restartPolicyType": "NEVER"
+	}
+}

apps/web/Dockerfile

@@ -1,17 +1,18 @@
-# syntax=docker.io/docker/dockerfile:1
-
 FROM node:24-alpine AS base
 RUN corepack enable
+RUN apk add --no-cache ffmpeg
 
 FROM base AS builder
 WORKDIR /app
 COPY . .
 
 RUN corepack enable pnpm
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm i --frozen-lockfile
+RUN if [ -f pnpm-lock.yaml ]; then pnpm i --frozen-lockfile; else pnpm i --no-frozen-lockfile; fi
 
 ARG NEXT_PUBLIC_DOCKER_BUILD=true
-ENV NEXT_PUBLIC_WEB_URL=http://localhost:3000
+ARG NEXT_PUBLIC_WEB_URL=http://localhost:3000
+ENV NEXT_PUBLIC_DOCKER_BUILD=${NEXT_PUBLIC_DOCKER_BUILD}
+ENV NEXT_PUBLIC_WEB_URL=${NEXT_PUBLIC_WEB_URL}
 
 RUN pnpm run build:web
 
@@ -30,6 +31,7 @@ COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/apps/web/.next/static ./apps/web/.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/apps/web/public ./apps/web/public
 COPY --from=builder --chown=nextjs:nodejs /app/packages/database/migrations ./apps/web/migrations
+COPY --from=builder --chown=nextjs:nodejs /app/packages/database/migrations ./migrations
 
 
 USER nextjs