0a78c98cc6
The theme selector and the appearance toggle are the custom elements go-bananas ships, loaded at run time. They are custom elements rather than components written here because the applications this service feeds are a mix of React, vanilla JavaScript and server-rendered HTML, and a custom element is the one shape all three can use with no build step, no import map, and no second copy of React to break the hooks. Every token in the stylesheet is now written as var(--bn-*, fallback). That ordering is the safety property: with no theme service configured the page renders exactly as it did before, and with one configured the same rules follow the palette. The navigation rail takes the contract's sunken surface and its paired foreground rather than a fixed dark navy, because a light appearance wants dark text there. THEME_BASE_URL is read from runtime-config.js, which the entrypoint rewrites from the environment on start, so one image serves every environment rather than baking a hostname into the bundle at build time. contract.test.ts fetches the live contract and asserts it defines every --bn-* variable this application consumes. A token renamed on the service would otherwise leave every var() resolving to its fallback, and the page would look correct while never actually following the palette. Verified it fails on a deliberately wrong token name. The image also had two USER lines, the second silently replacing the first with a uid that owns neither /app nor /tmp/nginx. nginx could not create its pid file or its temp paths, so the container failed to start. Confirmed by building both variants: the old one cannot write nginx's temp directory, the fixed one serves the front end, its hashed assets, and the /api proxy.
53 lines
2 KiB
Docker
53 lines
2 KiB
Docker
# Build the React frontend.
|
|
FROM node:26-alpine AS frontend
|
|
WORKDIR /src/frontend
|
|
COPY frontend/package.json frontend/package-lock.json ./
|
|
RUN npm ci
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
|
|
# Compile the API and seed binaries.
|
|
FROM golang:1.27.1-alpine AS backend
|
|
WORKDIR /src/backend
|
|
COPY backend/go.mod backend/go.sum ./
|
|
RUN go mod download
|
|
COPY backend/ ./
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/api ./cmd/api \
|
|
&& CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/seed ./cmd/seed
|
|
|
|
# Build the migration CLI separately so its dependencies stay out of the app layer.
|
|
FROM golang:1.27.1-alpine AS tools
|
|
RUN GOBIN=/out go install github.com/pressly/goose/v3/cmd/goose@v3.26.0
|
|
|
|
# Run the frontend and API behind one HTTP endpoint.
|
|
FROM alpine:3.22
|
|
RUN apk add --no-cache ca-certificates nginx tzdata \
|
|
&& addgroup -S app \
|
|
&& adduser -S -G app -u 10001 app \
|
|
&& mkdir -p /app/frontend /app/migrations /tmp/nginx \
|
|
&& chown -R app:app /app /tmp/nginx
|
|
|
|
WORKDIR /app
|
|
COPY --from=frontend --chown=app:app /src/frontend/dist/ ./frontend/
|
|
COPY --from=backend /out/api /usr/local/bin/api
|
|
COPY --from=backend /out/seed /usr/local/bin/seed
|
|
COPY --from=tools /out/goose /usr/local/bin/goose
|
|
COPY --chown=app:app backend/migrations/ ./migrations/
|
|
COPY docker/nginx.conf /etc/nginx/nginx.conf
|
|
COPY docker/entrypoint.sh /usr/local/bin/go-guess-entrypoint
|
|
|
|
# One user, and it owns everything the runtime writes to. A second USER line here
|
|
# silently replaced this one with a uid that owns neither /app nor /tmp/nginx, so
|
|
# nginx could not create its pid file or its temp paths and the container failed to
|
|
# start. nginx also ignores its own user directive when the master is not root, so
|
|
# its workers run as whoever this names.
|
|
USER app
|
|
EXPOSE 8080
|
|
ENV ADDRESS=:8081 \
|
|
APP_ENV=production \
|
|
FRONTEND_URL=http://localhost:8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
|
|
CMD wget -qO- http://127.0.0.1:8080/api/health >/dev/null || exit 1
|
|
|
|
ENTRYPOINT ["/usr/local/bin/go-guess-entrypoint"]
|