fix: write the runtime config in the web image too

The Kubernetes deployment runs the split go-guess-web image, which is a plain
nginx serving static files and never ran an entrypoint. The theme service origin
is therefore never written into runtime-config.js there, so the page would always
read the empty default and theming would be silently inert in the cluster while
working in local runs. The combined root image already did this; the split one
now does too.

The script lives beside the frontend Dockerfile because that image's build
context is ./frontend, which cannot see docker/.

The chart passes THEME_BASE_URL to the web container rather than the API: it is
read by the browser, not by the service. It stays absent when unset, so a
deployment with no theme service renders exactly as before.

deploy/helm/go-guess/templates/web-deployment.yaml

@@ -39,6 +39,14 @@ spec:
           imagePullPolicy: {{ .Values.web.image.pullPolicy }}
           securityContext:
             {{- toYaml .Values.web.securityContext | nindent 12 }}
+          env:
+            {{- with .Values.web.themeBaseUrl }}
+            # Read by the browser, not the API, so it goes to the web container:
+            # the entrypoint writes it into runtime-config.js on start. Empty keeps
+            # the application on its own styling.
+            - name: THEME_BASE_URL
+              value: {{ . | quote }}
+            {{- end }}
           ports:
             - name: http
               containerPort: 80

deploy/helm/go-guess/values.yaml

@@ -78,8 +78,13 @@ web:
   replicaCount: 2
   image:
     repository: batty1039.startdedicated.net:5000/go-guess-web
-    tag: "0.0.1"
+    tag: "0.1.0"
     pullPolicy: IfNotPresent
+  # Origin of the go-bananas runtime supplying the shared styling contract, for
+  # example https://bananas-dev.urpi.be. Empty keeps this application's own
+  # styles. The theme service must also allow this application's origin, or the
+  # browser refuses to load the controls from it.
+  themeBaseUrl: ""
   service:
     type: ClusterIP
     port: 80

frontend/Dockerfile

@@ -8,5 +8,11 @@ RUN npm run build
 FROM nginx:1.29-alpine
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist /usr/share/nginx/html
+# Writes runtime-config.js from the environment on start, so one image serves
+# every environment instead of baking a hostname into the bundle at build time.
+# It lives beside this Dockerfile because the build context is ./frontend.
+COPY entrypoint.sh /usr/local/bin/go-guess-frontend-entrypoint
+RUN chmod +x /usr/local/bin/go-guess-frontend-entrypoint
 EXPOSE 80
+ENTRYPOINT ["/usr/local/bin/go-guess-frontend-entrypoint"]
 CMD ["nginx", "-g", "daemon off;"]

frontend/entrypoint.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+# Writes the runtime configuration the page reads before the bundle runs, then
+# hands over to nginx.
+#
+# The front end is built once and served by many environments, so anything that
+# differs between them has to be resolved here rather than baked into the bundle.
+# Right now that is the origin of the theme service; an empty value leaves the
+# application on its own styling.
+set -eu
+
+CONFIG_DIR=/usr/share/nginx/html
+CONFIG_FILE="$CONFIG_DIR/runtime-config.js"
+
+# nginx serves its own error pages from this directory, so a read-only filesystem
+# would otherwise turn a missing file into a 500. The default is already in the
+# image, so this only replaces it.
+cat > "$CONFIG_FILE" <<CONFIG
+window.__GO_GUESS_CONFIG__ = { themeBaseUrl: "${THEME_BASE_URL:-}" }
+CONFIG
+
+exec "$@"