Admin
a791232f18
Add the browser edge (contract rev 8.2/9): a Preact/Vite SPA under web/, an embedded placeholder bundle, the /web/* auth and action handlers, and the explicit browser-action allowlist. The SPA and the API share the one plaintext :8080 listener; there is no second port and no peer edge, so main.go also drops the mTLS listener and the identity mounts in the debug compose fall away. /_manifest announces the web block only while the SPA is mounted (honesty rule), always with the single service port. The DSNs move to the shared database's scram-sha-256 credentials, matching rev 9's removal of the PKI layer. Committed web/bun.lock because web/package.json and vite.config.ts are new in this commit. src/web/dist/index.html is a hand-written placeholder, not a generated bundle: it keeps bare `go build`/`go vet` working from a clean checkout, while /web/dist (the real build output) stays gitignored.
51 lines
1.5 KiB
Docker
51 lines
1.5 KiB
Docker
# --- Web build stage (browser-edge SPA, contract §10.2) ---
|
|
# Produces /web/dist, copied into the Go build context as web/dist so the
|
|
# //go:embed all:web/dist directive in src/web_assets.go picks it up.
|
|
FROM oven/bun:1.3.9-alpine AS web-builder
|
|
WORKDIR /web
|
|
COPY web/package.json web/bun.lock ./
|
|
RUN bun ci
|
|
COPY web/ ./
|
|
RUN bun run build
|
|
|
|
# --- Build Stage ---
|
|
FROM golang:1.26 AS builder
|
|
WORKDIR /app
|
|
|
|
# Shared modules (git.dcntrlized.org/dcntrlized/dcntrlized-auth) are served by
|
|
# the dev Gitea Go module proxy. Override via --build-arg in production.
|
|
ARG GOPROXY_VALUE=http://192.168.122.183:3000/api/packages/Dcntrlized/go
|
|
ARG GONOSUMDB_VALUE=git.dcntrlized.org
|
|
ENV GOPROXY=${GOPROXY_VALUE},https://proxy.golang.org,direct
|
|
ENV GONOSUMDB=${GONOSUMDB_VALUE}
|
|
|
|
COPY src/go.mod src/go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY src/ ./
|
|
COPY --from=web-builder /web/dist ./web/dist
|
|
|
|
# Build the whole main package (not just main.go): the browser-edge SPA embed
|
|
# lives in web_assets.go, so a single-file build would not see embeddedWeb.
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -o server .
|
|
|
|
# --- Run Stage ---
|
|
FROM alpine:latest
|
|
WORKDIR /root/
|
|
|
|
ARG IMAGE_VERSION=dev
|
|
ARG IMAGE_REVISION=
|
|
|
|
LABEL org.dcntrlized.service=KeepNote
|
|
LABEL org.dcntrlized.port=8080
|
|
LABEL org.opencontainers.image.version=$IMAGE_VERSION
|
|
LABEL org.opencontainers.image.revision=$IMAGE_REVISION
|
|
|
|
COPY --from=builder /app/server .
|
|
|
|
# Contract rev 9 §3.3: exactly ONE plaintext listener (:8080) serves the API
|
|
# and the embedded browser web app (SPA + /web/*). No second port, no PKI.
|
|
EXPOSE 8080
|
|
|
|
CMD ./server
|