Final Push

next.config.ts

@@ -1,8 +1,43 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
+  // Output as a standalone bundle (used by the production Dockerfile)
   output: "standalone",
-  serverExternalPackages: ["pdfkit"],
+
+  // Security: hide the "X-Powered-By: Next.js" response header
+  poweredByHeader: false,
+
+  // Compress responses with gzip/brotli
+  compress: true,
+
+  // Server-only packages that must NOT be bundled by webpack
+  serverExternalPackages: ["pdfkit", "pdf-parse"],
+
+  // Allowed external image domains (UploadThing CDN + Clerk avatars)
+  images: {
+    remotePatterns: [
+      {
+        protocol: "https",
+        hostname: "utfs.io",
+        pathname: "/**",
+      },
+      {
+        protocol: "https",
+        hostname: "uploadthing.com",
+        pathname: "/**",
+      },
+      {
+        protocol: "https",
+        hostname: "img.clerk.com",
+        pathname: "/**",
+      },
+      {
+        protocol: "https",
+        hostname: "images.clerk.dev",
+        pathname: "/**",
+      },
+    ],
+  },
 };
 
 export default nextConfig;