build(docker): add runtime-configured frontend image

2026-07-11 21:57:53 +02:00
parent 31023f9e7a
commit 3d939426b1
9 changed files with 150 additions and 1 deletions
@@ -0,0 +1,57 @@
+# Container Packaging Task 4 Report
+
+## Status
+
+Implemented and verified runtime-configured frontend packaging.
+
+## Changes
+
+- Added the browser runtime contract `window.__THOTHII_CONFIG__.backendBaseUrl`.
+- Loaded `/config.js` before the Vite module entrypoint.
+- Made runtime configuration take precedence while preserving `VITE_BACKEND_URL` and the
+  existing `http://localhost:8787` client default for development and tests.
+- Added a multi-stage frontend image that builds with Node and serves static assets as
+  unprivileged UID/GID `101:101` with nginx on port 8080.
+- Added startup-time `BACKEND_BASE_URL` substitution (default `/api`).
+- Added `/api/` reverse proxying to `core:8787`, SPA fallback, no-cache runtime config,
+  and SSE-safe proxy settings (`proxy_buffering off`, `proxy_cache off`, one-hour read timeout).
+
+## TDD evidence
+
+- RED: `npx vitest run src/api/runtime-config.test.ts` failed because
+  `./runtime-config` did not exist.
+- GREEN: targeted runtime config suite passed (3 tests after preserving the legacy client
+  default).
+
+## Verification
+
+- `cd frontend && npx vitest run --reporter=dot && npx tsc -b && npm run build` — exit 0
+  (40 test files, 185 tests; TypeScript and Vite production build passed).
+- `docker build -f docker/frontend.Dockerfile -t thothii-frontend:test .` — success.
+- Image metadata reports `USER 101:101`.
+- Two-container isolated-network smoke:
+  - `/config.js` returned `window.__THOTHII_CONFIG__ = { backendBaseUrl: "/api" };`
+  - `/api/health` proxied to the core image and returned `{"status":"ok"}`.
+  - an unknown nested route returned the SPA `index.html`.
+  - active nginx config contained `proxy_buffering off`, `proxy_cache off`, and
+    `proxy_read_timeout 1h`.
+  - `/config.js` returned `Cache-Control: no-store`.
+- `sh -n docker/frontend-entrypoint.sh` and `git diff --check` — exit 0.
+
+## Secret-leakage inspection
+
+- `.dockerignore` excludes `.env*` (except examples), credentials/key formats, dependency
+  trees, build outputs, backend data, and deployment data.
+- The runtime web root contained no `.env*`, `.pem`, `.key`, `.p12`, or `.pfx` files.
+- Image history contained build/package instructions only; no secret build arguments or
+  credential values were introduced by this task.
+
+## Self-review / concerns
+
+- nginx resolves the `core` hostname at startup, matching the planned Compose service name;
+  standalone runs therefore need a reachable network alias named `core`.
+- Existing frontend test warnings (React refs/act, MSW unmatched incidental requests, Vite
+  chunk-size warnings) remain; they did not fail the requested gates and are unrelated to
+  this task.
+- `.superpowers/sdd/progress.md` was already modified by the orchestrator and was intentionally
+  excluded from this task's commit.