Niek Otten
a55ba1160d
The app loads /config.json at startup (main.ts) so the OIDC authority is set per environment from one build; appConfig becomes a factory and derives redirectUrl + secureApiOrigin from the app origin (same-origin as the BFF). A multi-stage Dockerfile builds the app and serves it via nginx, reverse-proxying /self-service + /openbaar to the bff (relative URLs → no CORS); nginx resolves the BFF at request time. The compose image bakes config.json with the keycloak:8080 authority so the browser's token issuer matches the BFF (ADR-0010). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
1.1 KiB
Docker
24 lines
1.1 KiB
Docker
# Multi-stage build for the self-service portal (Angular → nginx).
|
|
# Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml.
|
|
FROM node:24-slim AS build
|
|
WORKDIR /src
|
|
RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
|
|
|
|
# Restore first (cached unless the manifests change).
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Sources (only what the app + its libs need).
|
|
COPY apps/self-service apps/self-service
|
|
COPY libs libs
|
|
RUN pnpm nx build self-service
|
|
|
|
FROM nginx:1.27-alpine AS runtime
|
|
COPY apps/self-service/nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY --from=build /src/dist/apps/self-service/browser /usr/share/nginx/html
|
|
# Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
|
|
# service name, so the token issuer matches the BFF's authority (host-consistent, ADR-0010).
|
|
RUN printf '{ "authority": "http://keycloak:8080/realms/digid" }\n' > /usr/share/nginx/html/config.json
|
|
|
|
EXPOSE 80
|