web-app-chess: refactor runtime & entrypoint

- Move entrypoint to files/ and deploy via copy
- Parameterize APP_KEY_FILE, data dir, and entrypoint paths
- Require explicit PORT/PG envs (remove fallbacks)
- Drop stray header from config/main.yml
- Dockerfile: use templated data dir & entrypoint; keep node user
- Compose: set custom image, adjust volume mapping
- env: derive APP_SCHEME from WEB_PROTOCOL; NODE_ENV from ENVIRONMENT
- tasks: add 01_core and simplify main to include it

Ref: https://chatgpt.com/share/68b851c5-4dd8-800f-8e9e-22b985597b8f

roles/web-app-chess/templates/Dockerfile.j2

@@ -21,8 +21,6 @@ RUN yarn install --frozen-lockfile && yarn build
 # Stage 2: runtime
 FROM node:{{ CHESS_VERSION }}
 
-ENV NODE_ENV=production
-ENV PORT={{ container_port }}
 WORKDIR /app
 
 # Minimal runtime packages + dumb-init
@@ -34,14 +32,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 COPY --from=build /src /app
 
 # Create data dir for signing keys & cache
-RUN mkdir -p /app/data && chown -R node:node /app
-VOLUME ["/app/data"]
+RUN mkdir -p {{ CHESS_APP_DATA_DIR }} && chown -R node:node /app
+VOLUME ["{{ CHESS_APP_DATA_DIR }}"]
 
 # Entrypoint script
-COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+COPY {{ CHESS_ENTRYPOINT_REL }} {{ CHESS_ENTRYPOINT_INT }}
+RUN chmod +x {{ CHESS_ENTRYPOINT_INT }}
 
 USER node
 EXPOSE {{ container_port }}
 ENTRYPOINT ["dumb-init", "--"]
-CMD ["docker-entrypoint.sh"]
+CMD ["{{ CHESS_ENTRYPOINT_INT }}"]

roles/web-app-chess/templates/docker-compose.yml.j2

@@ -6,15 +6,13 @@
       args:
         CHESS_REPO_URL: "{{ CHESS_REPO_URL }}"
         CHESS_REPO_REF: "{{ CHESS_REPO_REF }}"
-    image: "castling_custom"
+    image: "{{ CHESS_CUSTOM_IMAGE }}"
     container_name: "{{ CHESS_CONTAINER }}"
     hostname: "{{ CHESS_HOSTNAME }}"
-    environment:
-      - NODE_ENV=production
     ports:
       - "127.0.0.1:{{ ports.localhost.http[application_id] }}:{{ container_port }}"
     volumes:
-      - 'data:/app/data'
+      - 'data:{{ CHESS_APP_DATA_DIR }}'
     env_file:
       - .env
 {% include 'roles/docker-container/templates/healthcheck/curl.yml.j2' %}

roles/web-app-chess/templates/docker-entrypoint.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-APP_KEY_FILE="${APP_KEY_FILE:-/app/data/{{ CHESS_KEY_FILENAME }}}"
-APP_KEY_PUB="${APP_KEY_FILE}.pub"
-
-# 1) Generate signing key pair if missing
-if [[ ! -f "${APP_KEY_FILE}" || ! -f "${APP_KEY_PUB}" ]]; then
-  echo "[chess] generating RSA signing key pair at ${APP_KEY_FILE}"
-  /app/tools/gen-signing-key.sh "${APP_KEY_FILE}"
-fi
-
-# 2) Wait for PostgreSQL if env is provided
-if [[ -n "${PGHOST:-}" ]]; then
-  echo "[chess] waiting for PostgreSQL at ${PGHOST}:${PGPORT:-5432}..."
-  until pg_isready -h "${PGHOST}" -p "${PGPORT:-5432}" -U "${PGUSER:-postgres}" >/dev/null 2>&1; do
-    sleep 1
-  done
-fi
-
-# 3) Run migrations (idempotent)
-echo "[chess] running migrations"
-yarn migrate up
-
-# 4) Start app
-echo "[chess] starting server on port ${PORT:-5080}"
-exec yarn start

roles/web-app-chess/templates/env.j2

@@ -1,11 +1,11 @@
 # App basics
-APP_SCHEME="{{ 'https' if WEB_PROTOCOL == 'https' else 'http' }}"
+APP_SCHEME="{{ WEB_PROTOCOL }}"
 APP_DOMAIN="{{ CHESS_HOSTNAME }}"
 APP_ADMIN_URL="{{ CHESS_ADMIN_URL }}"
 APP_ADMIN_EMAIL="{{ CHESS_ADMIN_EMAIL }}"
-APP_KEY_FILE="/app/data/{{ CHESS_KEY_FILENAME }}"
+APP_KEY_FILE="{{ CHESS_APP_KEY_FILE }}"
 APP_HMAC_SECRET="{{ CHESS_HMAC_SECRET }}"
-NODE_ENV="production"
+NODE_ENV="{{ ENVIRONMENT }}"
 PORT="{{ container_port }}"
 
 # PostgreSQL (libpq envs)