25458fd2a2
Adds a build-arg path so the Mapbox public token is injected at `vite build` time instead of being hardcoded in the bundle: - `frontend/Dockerfile` declares `ARG VITE_MAPBOX_TOKEN` in the builder stage and re-exports it via `ENV` so Vite picks it up. - `.woodpecker/frontend.yml` maps the global `wrongmove-mapbox-token` Woodpecker secret into a step-level `VITE_MAPBOX_TOKEN` env var, then forwards it via `build_args_from_env`. Token is a domain-restricted `pk.*` public token (Mapbox), so bundle exposure is the intended threat model. Vault-stored at `secret/ci/global/wrongmove-mapbox-token`; synced to Woodpecker by the existing vault-woodpecker-sync CronJob every 6h. Replaces the post-Fix-4 "Map unavailable — set VITE_MAPBOX_TOKEN" banner with a working basemap. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
63 lines
1.7 KiB
Docker
63 lines
1.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Stage 1: Install dependencies (cached if package-lock.json unchanged)
|
|
FROM node:24-alpine AS deps
|
|
|
|
WORKDIR /app
|
|
|
|
# Limit Node.js heap to avoid OOM in constrained CI environments
|
|
ENV NODE_OPTIONS="--max-old-space-size=1024"
|
|
|
|
# Copy package files first for better layer caching
|
|
COPY package.json package-lock.json* ./
|
|
|
|
RUN --mount=type=cache,target=/root/.npm \
|
|
npm ci
|
|
|
|
# Stage 2: Run tests (fails the build if tests fail)
|
|
FROM deps AS test
|
|
|
|
COPY . .
|
|
|
|
RUN npx vitest run
|
|
|
|
# Stage 3: Build production bundle
|
|
FROM deps AS builder
|
|
|
|
# Mapbox public token (pk.*) baked into the bundle by Vite via VITE_*.
|
|
# Domain-restricted in the Mapbox dashboard, so a leaked token is low risk.
|
|
ARG VITE_MAPBOX_TOKEN=""
|
|
ENV VITE_MAPBOX_TOKEN=$VITE_MAPBOX_TOKEN
|
|
|
|
COPY . .
|
|
|
|
# Skip tsc type-checking (vitest already validated); Vite transpiles via SWC
|
|
RUN npx vite build
|
|
|
|
# Stage 4: Serve with nginx
|
|
FROM nginx:alpine AS production
|
|
|
|
# Remove default nginx static files
|
|
RUN rm -rf /usr/share/nginx/html/*
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=builder /app/dist /usr/share/nginx/html
|
|
COPY --from=builder /app/nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
# Configure nginx to run as non-root
|
|
RUN chown -R nginx:nginx /usr/share/nginx/html && \
|
|
chown -R nginx:nginx /var/cache/nginx && \
|
|
chown -R nginx:nginx /var/log/nginx && \
|
|
touch /run/nginx.pid && chown nginx:nginx /run/nginx.pid && \
|
|
sed -i 's/listen 80;/listen 8080;/' /etc/nginx/conf.d/default.conf && \
|
|
sed -i 's/^user /#user /' /etc/nginx/nginx.conf
|
|
|
|
USER nginx
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
|
|
CMD wget --no-verbose --tries=1 --spider http://localhost:8080/ || exit 1
|
|
|
|
CMD ["nginx", "-g", "daemon off;"]
|