stroblme
4dfb1e1206
script-src admits the bundle and the pre-paint theme script by hash, with no unsafe-inline or unsafe-eval; style-src keeps unsafe-inline for the <style> elements Monaco, Radix and the toasts insert. frame-ancestors 'self', nosniff and strict-origin-when-cross-origin go with it, and the Dockerfile adds the API origin to connect-src when the bundle calls one elsewhere. Zod runs jitless so its eval probe is not reported on every page. The embed widget keeps allow-same-origin: the demo's weather map does not render without it; the comment now says so and what it costs.
36 lines
1.1 KiB
Docker
36 lines
1.1 KiB
Docker
# Stage 0, "build-stage", based on Bun, to build and compile the frontend
|
|
FROM oven/bun:1 AS build-stage
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package.json bun.lock /app/
|
|
|
|
COPY frontend/package.json /app/frontend/
|
|
|
|
WORKDIR /app/frontend
|
|
|
|
RUN bun install
|
|
|
|
COPY ./frontend /app/frontend
|
|
ARG VITE_API_URL
|
|
# Set only for the copy a portal serves; see vite.config.ts.
|
|
ARG VITE_BASE
|
|
|
|
RUN bun run build
|
|
|
|
|
|
# Stage 1, based on Nginx, to have only the compiled app, ready for production with Nginx
|
|
FROM nginx:1
|
|
|
|
COPY --from=build-stage /app/frontend/dist/ /usr/share/nginx/html
|
|
|
|
COPY ./frontend/nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY ./frontend/nginx-security-headers.conf /etc/nginx/security-headers.conf
|
|
# The CSP's connect-src names the API when the bundle calls it on another
|
|
# origin (https://api.x and wss://api.x); empty, nginx proxies it on this one.
|
|
ARG VITE_API_URL
|
|
RUN api="${VITE_API_URL%/}"; \
|
|
sed -i "s|__API_ORIGINS__|${api:+ $api $(echo "$api" | sed 's/^http/ws/')}|" \
|
|
/etc/nginx/security-headers.conf
|
|
COPY ./frontend/nginx-backend-not-found.conf /etc/nginx/extra-conf.d/backend-not-found.conf
|