feat(deploy): slim the celld image and migrate without drizzle-kit

turbo prune the Worker graph, drop oxlint/alchemy/wrangler from the
runtime, and apply Postgres migrations with drizzle-orm so the image
does not need drizzle-kit.

Co-Authored-By: Grok <grok@x.ai>

Author: xesrevinu

.dockerignore

@@ -8,6 +8,11 @@ target
 **/target
 apps/api/.data
 apps/api/.data/**
+apps/ios
+apps/web/dist
+**/.celld
+**/.wrangler
+**/.turbo
 .env
 .env.*
 **/.env

deploy/celld-self-host/compose.yml

@@ -186,7 +186,7 @@ services:
         set -euo pipefail
         export PATH="/usr/local/bin:/root/.bun/bin:$$PATH"
         cd /app
-        bun run --cwd packages/db db:migrate
+        bun run --cwd packages/db db:migrate:pg
         bun run --cwd packages/clickhouse-cli start apply \
           --url="$$CLICKHOUSE_URL" --user="$$CLICKHOUSE_USER" \
           --password="$$CLICKHOUSE_PASSWORD" --database="$$CLICKHOUSE_DATABASE"

deploy/celld-self-host/docker/Dockerfile.celld

@@ -1,47 +1,80 @@
-# celld Worker runtime. Same Maple Worker sources as Cloudflare; no alchemy.
-# Build from repo root: docker build -f deploy/celld-self-host/docker/Dockerfile.celld .
+# celld Worker runtime. Production graph only: api + electric-sync + alerting
+# (+ clickhouse-cli / db for the migrate job). Build from repo root:
+#   docker build -f deploy/celld-self-host/docker/Dockerfile.celld .
+
 FROM oven/bun:1.4.0 AS base
 WORKDIR /app
 
+FROM base AS pruner
+COPY . .
+RUN bunx turbo prune \
+	@maple/api \
+	@maple/alerting \
+	@maple/electric-sync \
+	@maple/clickhouse-cli \
+	--docker --out-dir /app/out
+
+FROM base AS deps
+COPY --from=pruner /app/out/json/ ./
+COPY --from=pruner /app/out/bun.lock ./bun.lock
+COPY bunfig.toml ./
+COPY patches ./patches
+# turbo prune keeps the root package.json, including oxlint/alchemy/knip.
+# Those are not Worker runtime. Drop them before bun install.
+RUN bun -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); p.devDependencies={}; p.scripts={}; fs.writeFileSync("package.json", JSON.stringify(p,null,2));'
+RUN bun install --ignore-scripts || bun install --ignore-scripts
+
+FROM deps AS build
+COPY --from=pruner /app/out/full/ ./
+# `out/full` restores the original root package.json; strip tooling again.
+RUN bun -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); p.devDependencies={}; p.scripts={}; fs.writeFileSync("package.json", JSON.stringify(p,null,2));'
+# Re-install with full sources so workspace bins (tsdown) resolve, then emit
+# dist/ for packages whose package.json exports point at dist/, not src/.
+RUN bun install --ignore-scripts || bun install --ignore-scripts
+RUN bun run --cwd lib/clickhouse-builder build && \
+	bun run --cwd packages/effect-sdk build
+
+# Drop workspace devDependencies (wrangler/workerd/miniflare/vitest).
+# Postgres migrate uses packages/db/scripts/migrate-pg.ts (drizzle-orm), not drizzle-kit.
+FROM build AS prod
+RUN rm -rf node_modules && bun install --production --ignore-scripts
+
+FROM oven/bun:1.4.0-slim AS runtime
+WORKDIR /app
+
 ARG CELLD_VERSION=v0.4.0
-ARG TARGETARCH=arm64
+ARG TARGETARCH
+ARG ESBUILD_VERSION=0.24.2
 
 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates curl gzip \
 	&& rm -rf /var/lib/apt/lists/*
 
 RUN set -euo pipefail; \
-	case "$TARGETARCH" in \
-		amd64) asset=celld-x86_64-unknown-linux-gnu.gz ;; \
-		arm64) asset=celld-aarch64-unknown-linux-gnu.gz ;; \
-		*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
+	arch="${TARGETARCH:-}"; \
+	if [ -z "$arch" ]; then \
+		case "$(uname -m)" in \
+			aarch64|arm64) arch=arm64 ;; \
+			x86_64|amd64) arch=amd64 ;; \
+			*) echo "unsupported arch $(uname -m)" >&2; exit 1 ;; \
+		esac; \
+	fi; \
+	case "$arch" in \
+		amd64) asset=celld-x86_64-unknown-linux-gnu.gz; plat=linux-x64 ;; \
+		arm64) asset=celld-aarch64-unknown-linux-gnu.gz; plat=linux-arm64 ;; \
+		*) echo "unsupported TARGETARCH=$arch" >&2; exit 1 ;; \
 	esac; \
 	curl -fsSL "https://github.com/denoland/celld/releases/download/${CELLD_VERSION}/${asset}" \
 		| gzip -d > /usr/local/bin/celld; \
 	chmod +x /usr/local/bin/celld; \
-	celld --version
-
-COPY package.json bun.lock bunfig.toml turbo.json ./
-COPY apps ./apps
-COPY packages ./packages
-COPY lib ./lib
-COPY patches ./patches
-
-ARG ESBUILD_VERSION=0.24.2
-RUN set -euo pipefail; \
-	case "$TARGETARCH" in \
-		amd64) plat=linux-x64 ;; \
-		arm64) plat=linux-arm64 ;; \
-		*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
-	esac; \
 	curl -fsSL "https://registry.npmjs.org/@esbuild/${plat}/-/${plat}-${ESBUILD_VERSION}.tgz" \
 		| tar -xz -C /tmp; \
 	install -m 0755 /tmp/package/bin/esbuild /usr/local/bin/esbuild; \
+	rm -rf /tmp/package; \
+	celld --version; \
 	esbuild --version
 
-# Workspace install can flake on npm (pglite/alchemy are unused at celld runtime).
-RUN bun install || bun install
-
+COPY --from=prod /app /app
 COPY deploy/celld-self-host/docker/entrypoint-celld.sh /entrypoint-celld.sh
 RUN chmod +x /entrypoint-celld.sh
 

deploy/celld-self-host/docker/entrypoint-celld.sh

@@ -1,7 +1,7 @@
-#!/usr/bin/env bash
+#!/bin/sh
 # Production celld: deploy the Worker into the fleet bucket, then serve it.
 # Not `celld dev` — that uses PROJECT/.celld/dev and shares nothing with prod.
-set -euo pipefail
+set -eu
 
 APP_DIR="${CELLD_APP_DIR:?CELLD_APP_DIR required}"
 PORT="${CELLD_PORT:?CELLD_PORT required}"
@@ -14,7 +14,7 @@ REGION="${AWS_REGION:-us-east-1}"
 cd "$APP_DIR"
 export PATH="/usr/local/bin:/root/.bun/bin:${PATH}"
 export CELLD_ESBUILD="${CELLD_ESBUILD:-$(command -v esbuild)}"
-if [[ -z "${CELLD_ESBUILD}" ]]; then
+if [ -z "${CELLD_ESBUILD}" ]; then
 	echo "celld-entrypoint: esbuild not on PATH" >&2
 	exit 1
 fi
@@ -27,11 +27,12 @@ mkdir -p "$CELLD_WATCH"
 echo "celld-entrypoint: deploy $CONFIG → $BUCKET ($ENDPOINT)"
 "$CELLD_BIN" deploy "$CONFIG" --bucket "$BUCKET" --endpoint "$ENDPOINT" --region "$REGION"
 
-echo "celld-entrypoint: listen 0.0.0.0:${PORT}"
+LISTEN_HOST="${CELLD_LISTEN_HOST:-0.0.0.0}"
+echo "celld-entrypoint: listen ${LISTEN_HOST}:${PORT}"
 exec "$CELLD_BIN" \
 	--bucket "$BUCKET" \
 	--endpoint "$ENDPOINT" \
 	--region "$REGION" \
-	--listen "0.0.0.0:${PORT}" \
+	--listen "${LISTEN_HOST}:${PORT}" \
 	--internal-listen "127.0.0.1:0" \
 	--trust-forwarded-headers

deploy/celld-self-host/k8s/migrate.yaml

@@ -28,7 +28,7 @@ spec:
               set -euo pipefail
               export PATH="/usr/local/bin:/root/.bun/bin:$PATH"
               cd /app
-              bun run --cwd packages/db db:migrate
+              bun run --cwd packages/db db:migrate:pg
               bun run --cwd packages/clickhouse-cli start apply \
                 --url="$CLICKHOUSE_URL" \
                 --user="$CLICKHOUSE_USER" \

docs/celld-self-host.md

@@ -282,6 +282,29 @@ deploy/celld-self-host/
   k8s/
 ```
 
+### Images
+
+`Dockerfile.celld` is a production graph, not a copy of the monorepo:
+
+1. `turbo prune @maple/api @maple/alerting @maple/electric-sync @maple/clickhouse-cli`
+2. strip root tooling (`oxlint` / `alchemy` / `knip`)
+3. build `clickhouse-builder` + `effect-sdk` `dist/`
+4. `bun install --production` (no wrangler / workerd / vitest)
+5. slim runtime: `oven/bun:1.4.0-slim` + celld + esbuild
+
+Migrate uses `bun run --cwd packages/db db:migrate:pg` (`drizzle-orm` migrator),
+not `drizzle-kit`, so the runtime image does not need that devDependency.
+
+Measured on arm64 (one image; api/sync/alerting share layers):
+
+| Image                         | Approx                                                   |
+| ----------------------------- | -------------------------------------------------------- |
+| `maple-celld`                 | 559 MB (was 3.35 GB with a full-workspace `bun install`) |
+| `maple-web`                   | 75 MB                                                    |
+| `maple-pg-ws-proxy`           | 185 MB (`bun` slim base)                                 |
+| `maple-otel`                  | 29 MB                                                    |
+| ClickHouse / Electric / Caddy | upstream                                                 |
+
 ## VPS notes
 
 A VPS bring-up is the data plane plus one celld process per public Worker:

packages/db/package.json

@@ -14,6 +14,7 @@
 		"test": "vitest run --passWithNoTests",
 		"db:generate": "drizzle-kit generate --config ./drizzle.config.ts",
 		"db:migrate": "drizzle-kit migrate --config ./drizzle.config.ts",
+		"db:migrate:pg": "bun scripts/migrate-pg.ts",
 		"db:ensure-electric-publication": "bun scripts/ensure-electric-publication.ts",
 		"db:push": "drizzle-kit push --config ./drizzle.config.ts",
 		"db:studio": "drizzle-kit studio --config ./drizzle.config.ts",

packages/db/scripts/migrate-pg.ts

@@ -0,0 +1,22 @@
+/**
+ * Apply bundled drizzle SQL to a real Postgres URL.
+ * Used by the celld self-host migrate Job so the runtime image does not need
+ * drizzle-kit (a db devDependency). Local/CI still use `db:migrate`.
+ */
+import { dirname, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+import { drizzle } from "drizzle-orm/postgres-js"
+import { migrate } from "drizzle-orm/postgres-js/migrator"
+import postgres from "postgres"
+
+const url = process.env.DATABASE_URL?.trim() || process.env.MAPLE_PG_URL?.trim()
+if (!url) {
+	console.error("migrate-pg: DATABASE_URL or MAPLE_PG_URL is required")
+	process.exit(1)
+}
+
+const migrationsFolder = resolve(dirname(fileURLToPath(import.meta.url)), "../drizzle")
+const sql = postgres(url, { max: 1 })
+await migrate(drizzle(sql), { migrationsFolder })
+await sql.end({ timeout: 5 })
+console.log("migrate-pg: applied", migrationsFolder)