cfe07f1900
Multi-stage Dockerfile (node:22-alpine + pnpm build -> nginx-unprivileged serve) producing a non-root image that runs under read-only fs + cap_drop ALL. nginx.conf does SPA-fallback routing, /healthz, immutable asset cache, and gzip, plus an opt-in same-origin reverse-proxy block. docs/docker.md documents build/run and the two ways to handle browser CORS on the web build (configure Honcho's CORSMiddleware, or the nginx proxy). The Dockerfile and nginx.conf are adapted from @zmarakjanbangash's fork. Co-authored-by: zmarakjanbangash <zmarakjanbangash@users.noreply.github.com>
55 lines
2.0 KiB
Nginx Configuration File
55 lines
2.0 KiB
Nginx Configuration File
# OpenConcho — nginx site config for the runtime container.
|
|
# Serves the React SPA from /usr/share/nginx/html with client-side routing.
|
|
|
|
server {
|
|
listen 8080;
|
|
listen [::]:8080;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Don't leak the nginx version.
|
|
server_tokens off;
|
|
|
|
# Long-cache static assets — Vite hashes filenames so they're safely immutable.
|
|
location ~* \.(?:js|mjs|css|woff2?|ttf|otf|eot|svg|png|jpg|jpeg|gif|ico|webp|avif|wasm)$ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
access_log off;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# Healthcheck (no logging spam).
|
|
location = /healthz {
|
|
access_log off;
|
|
default_type text/plain;
|
|
return 200 "ok\n";
|
|
}
|
|
|
|
# --- Optional: same-origin Honcho reverse proxy (eliminates browser CORS) ---
|
|
# The SPA's fetches are subject to browser CORS only on the web build (the
|
|
# desktop app routes through Rust and bypasses CORS). To avoid configuring
|
|
# CORS on Honcho itself, proxy the API under this origin and point the UI's
|
|
# base URL at it. See docs/docker.md for the full tradeoff — note the UI
|
|
# currently requires an absolute base URL, so this block is opt-in.
|
|
#
|
|
# location /honcho/ {
|
|
# proxy_pass http://your-honcho-host:8000/;
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# }
|
|
|
|
# SPA fallback: any unknown path returns index.html so the router resolves it.
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
}
|
|
|
|
# gzip text responses (Vite pre-compresses CSS/JS, but HTML still benefits).
|
|
gzip on;
|
|
gzip_types text/plain text/css application/javascript application/json image/svg+xml;
|
|
gzip_min_length 1024;
|
|
}
|