build(docker): add runtime-configured frontend image

docker/frontend-entrypoint.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+
+backend_base_url=${BACKEND_BASE_URL:-/api}
+escaped_backend_base_url=$(printf '%s' "$backend_base_url" | sed 's/[&|\\]/\\&/g')
+sed "s|__BACKEND_BASE_URL__|${escaped_backend_base_url}|g" \
+  /usr/share/nginx/html/config.template.js > /usr/share/nginx/html/config.js
+
+exec nginx -g 'daemon off;'

docker/frontend.Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1
+FROM node:22.19.0-bookworm-slim AS build
+WORKDIR /src/frontend
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY frontend/ ./
+RUN npm run build
+
+FROM nginxinc/nginx-unprivileged:1.27-alpine
+USER root
+COPY --from=build /src/frontend/dist /usr/share/nginx/html
+COPY docker/nginx.conf.template /etc/nginx/conf.d/default.conf
+COPY docker/frontend-entrypoint.sh /usr/local/bin/frontend-entrypoint
+RUN mv /usr/share/nginx/html/config.js /usr/share/nginx/html/config.template.js \
+    && sed -i 's|{}|{ backendBaseUrl: "__BACKEND_BASE_URL__" }|' /usr/share/nginx/html/config.template.js \
+    && chmod 0555 /usr/local/bin/frontend-entrypoint \
+    && chown -R 101:101 /usr/share/nginx/html
+
+EXPOSE 8080
+USER 101:101
+ENTRYPOINT ["/usr/local/bin/frontend-entrypoint"]

docker/nginx.conf.template

@@ -0,0 +1,26 @@
+server {
+    listen 8080;
+    server_name _;
+    root /usr/share/nginx/html;
+
+    location = /config.js {
+        add_header Cache-Control "no-store";
+        try_files $uri =404;
+    }
+
+    location /api/ {
+        proxy_pass http://core:8787/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 1h;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}