Niek Otten
a55ba1160d
The app loads /config.json at startup (main.ts) so the OIDC authority is set per environment from one build; appConfig becomes a factory and derives redirectUrl + secureApiOrigin from the app origin (same-origin as the BFF). A multi-stage Dockerfile builds the app and serves it via nginx, reverse-proxying /self-service + /openbaar to the bff (relative URLs → no CORS); nginx resolves the BFF at request time. The compose image bakes config.json with the keycloak:8080 authority so the browser's token issuer matches the BFF (ADR-0010). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
30 lines
946 B
Nginx Configuration File
30 lines
946 B
Nginx Configuration File
server {
|
|
listen 80;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts
|
|
# even before the BFF is up and picks up restarts — instead of failing to load the config.
|
|
resolver 127.0.0.11 ipv6=off valid=30s;
|
|
|
|
# Same-origin API: proxy the BFF endpoint groups to the bff service. The api-client uses relative
|
|
# URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the DigiD
|
|
# token (same-origin) is attached by the app's interceptor (S-08d/ADR-0010).
|
|
location /self-service/ {
|
|
set $bff http://bff:8080;
|
|
proxy_pass $bff;
|
|
proxy_set_header Host $host;
|
|
}
|
|
location /openbaar/ {
|
|
set $bff http://bff:8080;
|
|
proxy_pass $bff;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# SPA fallback — Angular client-side routing.
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|