Piattaforma ITI TECHNOLOGY: monorepo, Medusa, API, sito, area riservata e deploy

Monorepo npm con apps/public (Angular SSR), apps/private (Angular SPA),
apps/api (Fastify), packages/shared e packages/styles; Medusa 2.21 in medusa/;
infrastruttura Docker (Postgres PostGIS+pgvector, Redis, Caddy, backup) e
workflow Gitea Actions per il deploy via SSH a ogni push su master.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018jQyT6dR9czzGwqb7FkG6u

infra/caddy/Dockerfile

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+# Caddy (reverse proxy + TLS automatico) con dentro la build statica dell'area riservata (apps/private).
+# Contesto di build: radice del monorepo.
+#   docker build -f infra/caddy/Dockerfile -t iti-technology/caddy .
+# La configurazione dell'area riservata (/config.json) non è nella build: la genera Caddy dalle variabili
+# d'ambiente (vedi Caddyfile), quindi la stessa immagine vale per qualunque dominio.
+
+ARG NODE_IMAGE=node:24-bookworm-slim
+ARG CADDY_IMAGE=caddy:2-alpine
+
+FROM ${NODE_IMAGE} AS private-deps
+WORKDIR /repo
+COPY package.json package-lock.json tsconfig.base.json ./
+COPY packages/shared/package.json packages/shared/
+COPY apps/api/package.json apps/api/
+COPY apps/public/package.json apps/public/
+COPY apps/private/package.json apps/private/
+RUN npm ci --ignore-scripts --no-audit --no-fund -w @iti/private -w @iti/shared --include-workspace-root
+
+FROM private-deps AS private-build
+COPY packages/shared packages/shared
+COPY packages/styles packages/styles
+COPY apps/private apps/private
+RUN npm run build -w @iti/shared && npm run build -w @iti/private \
+  # in sviluppo config.json non esiste (404 → default); in produzione lo risponde Caddy
+  && rm -f apps/private/dist/private/browser/config.json
+
+FROM ${CADDY_IMAGE}
+COPY --from=private-build /repo/apps/private/dist/private/browser /srv/area
+COPY infra/caddy/Caddyfile /etc/caddy/Caddyfile
+COPY infra/caddy/sites /etc/caddy/sites