argoyle
b6812b9d55
Moves the production deploy from AWS to the Frostmoln production cluster (namespace `schemas`), with unboundsoftware/schemas. - `deploy-prod` (AWS, failing since CI left AWS) → `deploy-prod-frostmoln`: `deploy prod-frostmoln -n schemas`. - Restricted Pod Security: `nginxinc/nginx-unprivileged` (uid 101, port 8080; 1.31.7 isn't published for it yet, so 1.31.6). `nginx.conf`: no `user`, pid and temp paths under `/tmp`, `listen 8080`. Configs copied with `--chmod=644`. Service is ClusterIP. - `autoscale-prod`/`pdb-prod` → `-prod-frostmoln`; the ALB ingress → a Traefik one for `/` on `schemas.unbound.se` (the API's `/query` ingress wins on the longer path). Checked locally (amd64): as uid 101 with all capabilities dropped, `/health`, `/` and SPA routes 200, security headers present. **Merge with** the schemas PR, after infra#1878 is applied. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu Reviewed-on: #391
22 lines
889 B
Docker
22 lines
889 B
Docker
FROM cypress/base:26.0.0@sha256:446be8fcb63e3cad2f9a4e14720e3d8e35993e12f36da541e09f5740a4c2477c as builder
|
|
WORKDIR /build
|
|
|
|
RUN npm install --global node-gyp && \
|
|
git config --global --add safe.directory /build
|
|
|
|
COPY ./package.json ./package-lock.json ./
|
|
RUN npm ci --no-progress
|
|
COPY . /build
|
|
RUN npm run postinstall && npm run generate && npm run lint && npm run test:coverage
|
|
|
|
FROM scratch as export
|
|
COPY --from=builder /build/coverage /
|
|
|
|
# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
|
|
FROM nginxinc/nginx-unprivileged:1.31.6@sha256:1d26a516fb93b18f9c0214dc9c645054486e516f13ff09ef63d5bd5c622278a2
|
|
MAINTAINER Joakim Olsson <joakim@unbound.se>
|
|
|
|
COPY --chmod=644 ./nginx/nginx.conf /etc/nginx/nginx.conf
|
|
COPY --chmod=644 ./nginx/security_headers.conf /etc/nginx/security_headers.conf
|
|
COPY --from=builder /build/.output/public/ /usr/share/nginx/html/
|