Niek Otten
8a537edd6c
All checks were successful
## What & why Closes #96. The portal nginx configs hardcode `resolver 127.0.0.11` (Docker's embedded DNS) for their variable `proxy_pass` to the BFF, so on rootless **podman** (network-specific aardvark DNS) every proxied call 502'd — the portals loaded and login worked, but no in-app data flowed. Add a shared `/docker-entrypoint.d` hook (`apps/portal-nginx-resolver.sh`, wired into all three portal Dockerfiles) that rewrites the resolver from the container's own `/etc/resolv.conf` at startup: a **no-op on Docker** (nameserver *is* 127.0.0.11) and **correct on podman** (rewrites to e.g. 10.89.0.1). nginx.conf is unchanged (the hardcoded value is the substitution anchor). ## How verified Built the behandel image and ran it on the compose network under podman: the hook rewrote the config to `resolver 10.89.0.1`, and `GET /behandel/werkbak` proxied to the BFF returning **401** (auth), not 502. On Docker the nameserver is 127.0.0.11 so the substitution is a no-op and CI/e2e behaviour is unchanged. Reviewed-on: #97
26 lines
1.1 KiB
Docker
26 lines
1.1 KiB
Docker
# Multi-stage build for the openbaar portal (Angular → nginx).
|
|
# Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml.
|
|
FROM node:24-slim AS build
|
|
WORKDIR /src
|
|
RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
|
|
|
|
# Restore first (cached unless the manifests change).
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Sources (only what the app + its libs need).
|
|
COPY apps/openbaar apps/openbaar
|
|
COPY libs libs
|
|
RUN pnpm nx build openbaar
|
|
|
|
FROM nginx:1.27-alpine AS runtime
|
|
COPY apps/openbaar/nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY --from=build /src/dist/apps/openbaar/browser /usr/share/nginx/html
|
|
# No runtime config: the openbaar register is anonymous (no OIDC authority to inject).
|
|
# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
|
|
# the nginx image's /docker-entrypoint.d before nginx starts.
|
|
COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
|
|
RUN chmod +x /docker-entrypoint.d/40-resolver.sh
|
|
|
|
EXPOSE 80
|