mod(deploy): docker build deps version

Author: KUN1007

.vscode/settings.json

@@ -183,6 +183,7 @@
     "tname",
     "touchgal",
     "trimpath",
+    "trixie",
     "turbopack",
     "turbotrace",
     "Tyranor",

apps/api/cmd/server/main.go

@@ -23,10 +23,10 @@ func main() {
 	cfg := config.Load()
 
 	// `server healthcheck` (container HEALTHCHECK on distroless, which has no
-	// shell): probe the already-running server's /api/v1/health and exit 0/1.
+	// shell): probe the already-running server's /healthz and exit 0/1.
 	// No-op for the normal `server` invocation. Runs before app.New so the
 	// probe never touches the DB/Redis.
-	health.MaybeProbe(cfg.Server.Port, "/api/v1/health")
+	health.MaybeProbe(cfg.Server.Port, "/healthz")
 
 	application := app.New(cfg)
 	application.RegisterRoutes()

apps/api/internal/app/router.go

@@ -9,16 +9,16 @@ import (
 )
 
 func (a *App) RegisterRoutes() {
-	// Versioned API prefix, aligned with the frontend apiBase=http://host/api/v1
-	api := a.Fiber.Group("/api/v1")
-
-	// Liveness probe for container HEALTHCHECK (no auth, no DB touch). The
-	// `server healthcheck` subcommand GETs this and exits 0/1 — see
-	// cmd/server/main.go + pkg/health.
-	api.Get("/health", func(c *fiber.Ctx) error {
+	// Liveness probe — root /healthz, used by container HEALTHCHECK (no auth, no
+	// DB touch). The `server healthcheck` subcommand GETs this and exits 0/1 —
+	// see cmd/server/main.go + pkg/health. Unified to /healthz across services.
+	a.Fiber.Get("/healthz", func(c *fiber.Ctx) error {
 		return c.JSON(fiber.Map{"status": "ok"})
 	})
 
+	// Versioned API prefix, aligned with the frontend apiBase=http://host/api/v1
+	api := a.Fiber.Group("/api/v1")
+
 	auth := middleware.Auth(a.RDB, a.Config.OAuth)
 	optionalAuth := middleware.OptionalAuth(a.RDB, a.Config.OAuth)
 	// OAuth role mapping (see docs/user-migration/02-data-mapping.md §7):

docker/go.Dockerfile

@@ -13,7 +13,7 @@
 ARG GO_VERSION=1.26
 
 # ---- build ----
-FROM golang:${GO_VERSION}-bookworm AS build
+FROM golang:${GO_VERSION}-trixie AS build
 WORKDIR /src
 # Manifests first → module-download layer is cached until go.mod/sum change.
 COPY apps/api/go.mod apps/api/go.sum ./
@@ -28,7 +28,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" \
 # (outbound HTTPS: OAuth, Wiki, image_service, B2/S3, SMTP TLS) + tzdata.
 # The server self-probes via `/app healthcheck` (pkg/health) for the container
 # HEALTHCHECK, since distroless has no shell/wget. Ports live in compose.
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM gcr.io/distroless/static-debian13:nonroot
 COPY --from=build /out/app /app
 USER nonroot:nonroot
 ENTRYPOINT ["/app"]

docker/nuxt.Dockerfile

@@ -16,9 +16,9 @@
 # NOTE: the image CDN (`imageBed`) is still HARDCODED in app/config/moyu-moe.ts
 # (not env-driven) — align it with image_service before relying on hash-
 # addressed avatar/banner display. See docker/README.md §image_service.
-ARG NODE_VERSION=22
+ARG NODE_VERSION=24
 
-FROM node:${NODE_VERSION}-bookworm-slim AS base
+FROM node:${NODE_VERSION}-trixie-slim AS base
 RUN corepack enable
 WORKDIR /repo
 
@@ -60,7 +60,7 @@ RUN pnpm --filter "@apps/${APP}" run build
 
 # ---- run: just Node + the self-contained .output (no pnpm, no sources) ----
 # sharp ships inside .output (built for linux in this same arch container).
-FROM node:${NODE_VERSION}-bookworm-slim AS run
+FROM node:${NODE_VERSION}-trixie-slim AS run
 ARG APP=web
 ENV NODE_ENV=production HOST=0.0.0.0 NITRO_PORT=3000
 WORKDIR /app