mikkeli
5420975f8e
Cloudflare forces browser caching of .js/.css to max-age=14400 regardless of the origin's no-cache, while the page itself stays uncached. After a deploy, browsers paired the new index.html with the old app.js, which failed on upload with "Cannot set properties of null (setting 'innerHTML')". The image build now copies every asset into v/<content hash>/ and rewrites index.html's references; nginx serves v/ as immutable and the page as no-cache, so each deploy changes every asset URL. Security headers move to a snippet included per location, since nginx drops server-level add_header in locations that set their own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015UXA39Sh9coAx4FhRkd8R2
39 lines
1.9 KiB
Docker
39 lines
1.9 KiB
Docker
# uj-mastering-master — web UI
|
|
#
|
|
# The web UI is a static site: decoding and every metric run in the visitor's
|
|
# browser (web/dsp.js inside a Web Worker). This image only serves files — no
|
|
# application server, no upload endpoint, nothing written anywhere — so it runs
|
|
# read-only as nginx's unprivileged user. See deploy/nginx.conf for the CSP that
|
|
# stops the page from making network requests at all.
|
|
#
|
|
# The desktop app (PyQt5) is unaffected and not part of this image.
|
|
|
|
# ---- assets: version every file except the page by content ------------------
|
|
# Everything but index.html goes under v/<hash of the assets>/, and index.html's
|
|
# references are rewritten to match. Each deploy therefore changes every asset
|
|
# URL, so no cache (browser or Cloudflare, which forces .js/.css browser caching
|
|
# to 4 h) can pair a new index.html with an old app.js. Module imports and the
|
|
# worker URL are relative, so they resolve inside the versioned directory as is.
|
|
FROM alpine:3.22 AS assets
|
|
COPY web/ /src/
|
|
RUN set -eu; \
|
|
cd /src; \
|
|
v="$(find . -type f ! -name index.html | sort | xargs sha256sum | sha256sum | cut -c1-12)"; \
|
|
mkdir -p "/out/v/$v"; \
|
|
for f in *; do [ "$f" = index.html ] || cp -R "$f" "/out/v/$v/"; done; \
|
|
sed -E "s#(href|src)=\"(app\.css|app\.js|vendor/[^\"]+)\"#\1=\"v/$v/\2\"#g" index.html > /out/index.html; \
|
|
grep -q "src=\"v/$v/app.js\"" /out/index.html; \
|
|
grep -q "href=\"v/$v/app.css\"" /out/index.html
|
|
|
|
# ---- runtime -------------------------------------------------------------------
|
|
FROM nginxinc/nginx-unprivileged:stable-alpine
|
|
|
|
COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY deploy/security-headers.conf /etc/nginx/snippets/ujm-security-headers.conf
|
|
COPY --from=assets /out/ /usr/share/nginx/html/
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
|
CMD wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1
|