dc90e7404b
All checks were successful
Docker / build-and-push (push) Successful in 46s
Was a Vite build-time env var, requiring a second copy of a non-secret value as a separate Gitea CI secret alongside the one already in .env for the api service. Client id isn't sensitive (public in every Spotify authorize URL), so it doesn't need build-time baking at all — now fetched once from a new GET /api/config on the already-running api server, cached client-side after the first call. Collapses config back down to the one place it already lived (the deploy host's .env / docker-compose environment), removes the CI build-arg and its secret entirely. Verified end-to-end: /api/config returns the real client id, and a live guest-login click correctly carries it through into the actual Spotify authorize URL (decoded and checked, not just assumed from the code).
25 lines
1.1 KiB
Docker
25 lines
1.1 KiB
Docker
# ── Stage 1: build the Vite client ────────────────────────────────────────
|
|
FROM node:22-alpine AS build
|
|
|
|
WORKDIR /app/client
|
|
COPY client/package.json client/package-lock.json* ./
|
|
RUN npm install
|
|
COPY client/ .
|
|
|
|
# Deliberately empty: relies on nginx same-origin-proxying /api to the
|
|
# api service (see nginx.conf) instead of an absolute cross-origin URL
|
|
# — the CORS bug that broke local dev earlier in this build. No
|
|
# SPOTIFY_CLIENT_ID build-arg needed — the client fetches it from
|
|
# /api/config at runtime instead (see client/src/lib/pkce.ts); it's not
|
|
# sensitive data, and this keeps it configured in exactly one place
|
|
# (the server's own .env), not a second copy baked in here.
|
|
ENV VITE_API_BASE=
|
|
|
|
RUN npx tsc && npx vite build
|
|
|
|
# ── Stage 2: serve ─────────────────────────────────────────────────────────
|
|
FROM nginx:alpine
|
|
COPY --from=build /app/client/dist /usr/share/nginx/html
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
EXPOSE 80
|