flatten app to repo root and update docker deployment for single-stack runtime

.dockerignore

@@ -0,0 +1,20 @@
+# Build output and local caches
+.next
+.cache
+
+# Dependencies
+node_modules
+
+# Local runtime data and environment
+.env
+.env.local
+.env.*.local
+data
+
+# Editor/system files
+.DS_Store
+*.log
+
+# Git
+.git
+.gitignore

.env.example

@@ -1,5 +1,6 @@
 # Optional API override. Leave empty to use same-origin internal API routes.
 NEXT_PUBLIC_API_URL=
+APP_PORT=3000
 
 # OpenClaw / ZeroClaw (OpenAI-compatible)
 OPENCLAW_BASE_URL=http://localhost:4000

.gitignore

@@ -37,4 +37,4 @@ out/
 *.sqlite
 
 # Local app runtime state
-frontend/data/*.json
+data/*.json

Dockerfile

@@ -3,12 +3,13 @@ FROM node:20-alpine AS base
 WORKDIR /app
 
 FROM base AS deps
-COPY package.json ./
+COPY package.json package-lock.json ./
-RUN npm install
+RUN npm ci
 
 FROM base AS builder
 ARG NEXT_PUBLIC_API_URL=
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
+ENV NEXT_TELEMETRY_DISABLED=1
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 RUN mkdir -p public && npm run build
@@ -19,18 +20,21 @@ WORKDIR /app
 ENV NODE_ENV=production
 ARG NEXT_PUBLIC_API_URL=
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
+ENV NEXT_TELEMETRY_DISABLED=1
 
+RUN apk add --no-cache su-exec
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
 
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-USER nextjs
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
 EXPOSE 3000
 
 ENV PORT=3000
 
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["node", "server.js"]

README.md

@@ -13,7 +13,6 @@ Turbopack-first rebuild of a fiscal.ai-style terminal with OpenClaw integration.
 ## Run locally
 
 ```bash
-cd frontend
 npm install
 npm run dev
 ```
@@ -23,14 +22,23 @@ Open [http://localhost:3000](http://localhost:3000).
 ## Production build
 
 ```bash
-cd frontend
 npm run build
 npm run start
 ```
 
+## Docker deployment
+
+```bash
+cp .env.example .env
+docker compose up --build -d
+```
+
+Default app URL: `http://localhost:3000` (override with `APP_PORT` in `.env`).
+Runtime data persists in the `app_data` volume (`/app/data` in container).
+
 ## Environment
 
-Use root `.env` or `frontend/.env.local`:
+Use root `.env` or root `.env.local`:
 
 ```env
 # leave blank for same-origin API

docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   app:
     build:
-      context: ./frontend
+      context: .
       dockerfile: Dockerfile
       args:
         NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-}
@@ -17,5 +17,15 @@ services:
       OPENCLAW_API_KEY: ${OPENCLAW_API_KEY:-}
       OPENCLAW_MODEL: ${OPENCLAW_MODEL:-zeroclaw}
       SEC_USER_AGENT: ${SEC_USER_AGENT:-Fiscal Clone <support@fiscal.local>}
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
     ports:
-      - '3000:3000'
+      - '${APP_PORT:-3000}:3000'
+    volumes:
+      - app_data:/app/data
+
+volumes:
+  app_data:

docker-entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+set -e
+
+mkdir -p /app/data
+chown -R nextjs:nodejs /app/data
+
+exec su-exec nextjs "$@"

lib/server/store.ts

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import type { Filing, Holding, PortfolioInsight, Task, WatchlistItem } from '@/lib/types';
 
@@ -74,7 +74,9 @@ async function readStore(): Promise<DataStore> {
 }
 
 async function writeStore(store: DataStore) {
-  await writeFile(STORE_PATH, JSON.stringify(store, null, 2), 'utf8');
+  const tempPath = `${STORE_PATH}.tmp`;
+  await writeFile(tempPath, JSON.stringify(store, null, 2), 'utf8');
+  await rename(tempPath, STORE_PATH);
 }
 
 function cloneStore(store: DataStore): DataStore {