Skip to content

0009 — Next.js standalone admin portal

Status: reconstructed — needs confirmation

Context

Back-office staff need a browser UI over the admin API with role-based navigation and session auth, deployable as one small container.

Decision

digigold-admin/ is a Next.js App Router app (output: 'standalone' in next.config.js), served on port 3002 behind Caddy at admin.aimgold.org. Auth is NextAuth credentials flow against the admin API's /v1/auth/login (lib/auth.ts); the browser never holds the API bearer token — server routes proxy calls and inject it (app/api/proxy/[...path]/route.ts). Role gating for navigation lives in lib/permissions.ts (SUPER_ADMIN > ADMIN > SUPPORT).

Consequences

  • The admin API stays token-based and portal-agnostic; the portal adds cookie-session ergonomics on top.
  • NEXT_PUBLIC_* values are baked at image build time (digigold-admin/Dockerfile); runtime env only affects server-side code.
  • The portal container needs only NEXTAUTH_URL, NEXTAUTH_SECRET, and ADMIN_API_INTERNAL_URL — backend secrets never enter it (deploy/docker-compose.yml uses a separate portal.env.production).