I have trouble finding any useful documentation on how to properly set up a gatsby side that is using SSR (server side rendering) in a custom production environment (not Gatsby Cloud or Netlify)
In their documentation for SSR there's a section
Server-Side Rendering requires a running NodeJS server. You can put NodeJS running gatsby serve behind a content delivery network (CDN) like Fastly, however that also requires additional infrastructure (like monitoring, logging, and crash-recovery).
So my general idea would be to put this all inside some Docker container and run gatsby serve
However according to the documentation for gatsby serve (https://www.gatsbyjs.com/docs/reference/gatsby-cli/#serve )this is not supposed to be used for production
At the root of a Gatsby site, serve the production build of your site for testing
Is it ok to use serve production? What kind of security issues do I need to keep in mind when using it? Is there a detailed documentation how to set this up in a custom environment?
No docs on the SSR mode on custom servers. But in general you'd want to use something like Express to serve the static files (not gatsby serve) and then you can look at gatsby-plugin-netlify and gatsby-plugin-fastify for inspiration as they support SSR.
The serving and runtime SSR logic you’d have to write yourself using those plugins I mentioned as inspiration. The framework doesn’t handle the serving of the app, platforms like Gatsby Cloud and Netlify do. Or in your case, a custom server.
You might find this useful https://github.com/wille/gatsby-plugin-express Should also know there are lots of super easy ways to deploy (Gatsby Cloud, Netlify, Vercel) so you don’t need your own server. The reason you can’t use serve command is things like caching, redirects, headers, etc.