ssmithxandClaude Opus 5.5
cbf50fa64b
So the player works as a self-contained app install, not only behind a host nginx that provides /fips/. - nginx.conf: full main config with the /fips/ gateway — podsteadr catalogs/feeds on 8095 and blossom blobs on 8098 only, GET/HEAD only, no client cookies or credentials, everything else under /fips/ 404s - njs/fips.js: computes an npub.fips host's mesh address (fd || sha256(pubkey)[:15], bech32 checksum verified), so the gateway needs IPv6 egress to the mesh but no DNS; fips.test.js checks it against three real nodes' addresses - runtime image is nginx-unprivileged 1.30.6 (uid 101): no capabilities, read-only root with writable state in /tmp, /healthz for probes - the app explains that only npub.fips hosts can be relayed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
737 B
Docker
22 lines
737 B
Docker
# ---- build ----
|
|
FROM docker.io/library/node:22-bookworm-slim AS build
|
|
WORKDIR /build
|
|
COPY package*.json ./
|
|
RUN npm ci
|
|
COPY . .
|
|
# Root deploys (own port, no reverse-proxy prefix) leave this unset and default to '/'.
|
|
ARG VITE_BASE=/
|
|
ENV VITE_BASE=$VITE_BASE
|
|
RUN npm run build
|
|
|
|
# ---- runtime ----
|
|
# Unprivileged nginx (uid 101, no capabilities needed to serve :8097), with the
|
|
# njs module the /fips/ gateway uses.
|
|
FROM docker.io/nginxinc/nginx-unprivileged:1.30.6-alpine
|
|
COPY nginx.conf /etc/nginx/nginx.conf
|
|
COPY njs/fips.js /etc/nginx/njs/fips.js
|
|
COPY --from=build /build/dist /usr/share/nginx/html
|
|
EXPOSE 8097
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD wget -qO- http://localhost:8097/healthz >/dev/null || exit 1
|