fix(self-host): add USER node + HEALTHCHECK to Dockerfile; add E2E spec

- Dockerfile: run as non-root node user (security hardening)
- Dockerfile: add HEALTHCHECK via fetch to /health
- README: Docker self-hosting quick-start section
- tests/e2e/94-self-host-smoke.spec.ts: smoke tests for self-hosted instance

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: lane711

Dockerfile

@@ -67,5 +67,12 @@ ENV SONICJS_STORAGE_PATH=/app/data/media
 ENV SONICJS_KV_PATH=/app/data/kv.json
 ENV PORT=3000
 
+# Run as non-root for security.
+RUN chown -R node:node /app
+USER node
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://localhost:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
 # Run via Node with native ESM + TypeScript stripping (Node 22+).
 CMD ["node", "--experimental-strip-types", "my-sonicjs-app/src/self-host.ts"]

README.md

@@ -29,6 +29,25 @@ npx create-sonicjs@latest my-app
 
 > **⚠️ Note:** This repository is for **developing the SonicJS core package**. To build an application with SonicJS, use the command above to create a new project.
 
+## 🐳 Self-Hosting with Docker
+
+No Cloudflare account? Run SonicJS on any server with Docker and SQLite:
+
+```bash
+docker build -t sonicjs .
+docker run -d --name sonicjs -p 3000:3000 \
+  -v $(pwd)/data:/app/data \
+  -e JWT_SECRET=$(openssl rand -base64 32) \
+  -e BETTER_AUTH_SECRET=$(openssl rand -base64 32) \
+  sonicjs
+
+# Create the first admin user
+docker exec sonicjs npm run reset
+# → admin@sonicjs.com / sonicjs! (change after first login)
+```
+
+See the [Self-Hosting guide](https://sonicjs.com/self-hosting) for Docker Compose, Node.js, backup strategy, and production hardening.
+
 ## 🚀 Features
 
 ### Core Platform

tests/e2e/94-self-host-smoke.spec.ts

@@ -0,0 +1,94 @@
+import { test, expect } from '@playwright/test'
+
+/**
+ * Self-Host Smoke Tests
+ *
+ * Validates the Docker / Node.js self-hosted server (non-Cloudflare deployment).
+ * These tests run against a self-hosted instance started with `npm run self-host`.
+ *
+ * Set BASE_URL=http://localhost:3000 when running against a self-hosted instance.
+ *
+ * Covers:
+ * - Health endpoint
+ * - Sign-up and sign-in via better-auth credential flow
+ * - Admin panel access after seeding
+ * - Content and media routes reachable
+ */
+
+const SELF_HOST_EMAIL = process.env.SONICJS_ADMIN_EMAIL ?? 'admin@sonicjs.com'
+const SELF_HOST_PASSWORD = process.env.SONICJS_ADMIN_PASSWORD ?? 'sonicjs!'
+
+test.describe('Self-Host Smoke Tests', () => {
+  test('health endpoint returns ok', async ({ request }) => {
+    const res = await request.get('/health')
+    expect(res.ok()).toBeTruthy()
+    const body = await res.json()
+    // Self-host health check returns { status: 'ok' } (minimal)
+    expect(body).toHaveProperty('status')
+    expect(['ok', 'running']).toContain(body.status)
+  })
+
+  test('unauthenticated /admin redirects to login', async ({ page }) => {
+    await page.goto('/admin')
+    await page.waitForURL(/\/(admin\/login|auth\/login)/)
+    expect(page.url()).toMatch(/login/)
+  })
+
+  test('sign-in with seeded admin credentials', async ({ page }) => {
+    await page.goto('/admin')
+    await page.waitForURL(/login/)
+
+    // Fill credentials
+    const emailField = page.locator('input[type="email"], input[name="email"]').first()
+    const passwordField = page.locator('input[type="password"], input[name="password"]').first()
+    await emailField.fill(SELF_HOST_EMAIL)
+    await passwordField.fill(SELF_HOST_PASSWORD)
+
+    await page.locator('button[type="submit"], input[type="submit"]').first().click()
+
+    // Should land on admin dashboard
+    await page.waitForURL(/\/admin/, { timeout: 10_000 })
+    expect(page.url()).toContain('/admin')
+
+    // Should NOT still be on login
+    expect(page.url()).not.toMatch(/login/)
+  })
+
+  test('admin content route accessible after sign-in', async ({ page, request }) => {
+    // Sign in via API
+    const signIn = await request.post('/auth/sign-in/email', {
+      data: { email: SELF_HOST_EMAIL, password: SELF_HOST_PASSWORD },
+    })
+    expect(signIn.ok()).toBeTruthy()
+
+    const cookies = signIn.headers()['set-cookie']
+    expect(cookies).toBeTruthy()
+
+    // Admin content page should return 200
+    const content = await request.get('/admin/content')
+    expect(content.ok()).toBeTruthy()
+  })
+
+  test('admin media route accessible after sign-in', async ({ request }) => {
+    const signIn = await request.post('/auth/sign-in/email', {
+      data: { email: SELF_HOST_EMAIL, password: SELF_HOST_PASSWORD },
+    })
+    expect(signIn.ok()).toBeTruthy()
+
+    const media = await request.get('/admin/media')
+    expect(media.ok()).toBeTruthy()
+  })
+
+  test('sign-up creates a new user (self-host allows registration)', async ({ request }) => {
+    const unique = `e2e-${Date.now()}@test.sonicjs.local`
+    const res = await request.post('/auth/sign-up/email', {
+      data: {
+        email: unique,
+        password: 'TestPassword1!',
+        name: 'E2E Test User',
+      },
+    })
+    // 200 = success, 409 = already exists (idempotent re-run)
+    expect([200, 409]).toContain(res.status())
+  })
+})