From 38ff7365e862625c50d88974b5cce9dc462b3bd6 Mon Sep 17 00:00:00 2001
From: Hugo Gu <hugogu@outlook.com>
Date: Wed, 13 May 2026 21:45:37 +0800
Subject: [PATCH 1/2] fix(docker): install ca-certificates in runtime image for
 TLS verification (#1545) (#1547)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Close: #1545

Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
---
 Dockerfile.cli | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile.cli b/Dockerfile.cli
index 60b56451f..05bedd6c3 100644
--- a/Dockerfile.cli
+++ b/Dockerfile.cli
@@ -40,8 +40,8 @@ RUN npm prune --omit=dev --prefix gitnexus
 # node:22-bookworm-slim
 FROM node:22-bookworm-slim@sha256:9f6d5975c7dca860947d3915877f85607946403fc55349f39b4bc3688448bb6e AS runtime
 
-# curl for the healthcheck; git so `gitnexus` can clone repos at runtime.
-RUN apt-get update && apt-get install -y --no-install-recommends curl git && rm -rf /var/lib/apt/lists/* \
+# curl for the healthcheck; git for cloning; ca-certificates for TLS verification.
+RUN apt-get update && apt-get install -y --no-install-recommends curl git ca-certificates && rm -rf /var/lib/apt/lists/* \
     && rm -rf /usr/local/lib/node_modules/npm \
     && rm -rf /usr/local/lib/node_modules/corepack \
     && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack

From 507f84b69af29f6a5596538a59175bd930d07e57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9on=20Simmons?= <Avicennasis@gmail.com>
Date: Wed, 13 May 2026 12:14:52 -0400
Subject: [PATCH 2/2] fix(docker): symlink gitnexus binary onto $PATH in
 runtime image (#1551)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The README documents the Docker workflow as:

    WORKSPACE_DIR=$HOME/code docker compose up -d
    docker compose exec gitnexus-server gitnexus index /workspace/my-repo

…but `gitnexus` is not on $PATH inside the published image:

    $ docker compose exec gitnexus-server which gitnexus
    (empty)
    $ docker compose exec gitnexus-server gitnexus --version
    exec: "gitnexus": executable file not found in $PATH

The package.json `bin` entry (`"gitnexus": "dist/cli/index.js"`) would
normally surface via `node_modules/.bin/gitnexus`, but `npm prune
--omit=dev` in the builder stage strips that directory before the runtime
stage copies it in. The `dist/cli/index.js` itself already has the
`#!/usr/bin/env node` shebang and 755 permissions, so a single symlink
into /usr/local/bin makes the README's literal command work.

Verified locally:

    $ docker build -f Dockerfile.cli -t gitnexus:local-pr-test .
    $ docker run --rm gitnexus:local-pr-test gitnexus --version
    1.6.4
    $ docker run --rm gitnexus:local-pr-test gitnexus --help
    Usage: gitnexus [options] [command]
    …
    $ docker run --rm -d --name t gitnexus:local-pr-test \
      && sleep 4 && docker exec t curl -s localhost:4747/api/health
    {"status":"ok"}

CMD continues to invoke `node gitnexus/dist/cli/index.js serve …`
unchanged, so the change is additive and the server boot path is
untouched.

Refs #1549.
---
 Dockerfile.cli | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Dockerfile.cli b/Dockerfile.cli
index 05bedd6c3..3275c8f7e 100644
--- a/Dockerfile.cli
+++ b/Dockerfile.cli
@@ -58,6 +58,15 @@ COPY --from=builder --chown=node:node /app/gitnexus/package.json ./gitnexus/pack
 COPY --from=builder --chown=node:node /app/gitnexus/scripts/install-duckdb-extension.mjs ./gitnexus/scripts/install-duckdb-extension.mjs
 COPY --from=builder --chown=node:node /app/gitnexus/vendor ./gitnexus/vendor
 
+# Expose the `gitnexus` binary on PATH so the documented Docker workflow
+# (`docker compose exec gitnexus-server gitnexus index /workspace/<repo>`)
+# works without users having to invoke `node /app/gitnexus/dist/cli/index.js`.
+# `npm prune --omit=dev` in the builder stage strips `node_modules/.bin/`
+# entries, so the `gitnexus` bin declared in package.json (`dist/cli/index.js`,
+# which already carries `#!/usr/bin/env node` and 755 perms) is otherwise
+# unreachable from $PATH.
+RUN ln -s /app/gitnexus/dist/cli/index.js /usr/local/bin/gitnexus
+
 USER node
 
 # The web UI defaults to http://localhost:4747 - keep that contract.