stack-service-base 0.0.99 → 0.0.100

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3db078c7ea6acaca31ec7b32b7991fd213dcaacd03fcab42733f8f3d299b6456
-  data.tar.gz: 621b4b6c3b116f0f72555740ca83f9f62029e0a58b3d19655fdf77db45f27a5b
+  metadata.gz: 6d908ed870ee59a5ea085accfe3bc86f2276baeca5780407917af9a59e5eebb7
+  data.tar.gz: b7d31c74bbdcd98f55d827ed9630c17f42aaf5f503a9585ade7288b8c6754def
 SHA512:
-  metadata.gz: 0ecbb4d62eb789d83cbbc72d422ed7316a5ac486d1cf3dbcf538cd253aefb156d3dcb71b5937e5bd9f99e9360c10310fea242d42abda559532d2ba73594b9213
-  data.tar.gz: 4d3d7862b719bcb04d26881dada64385c2a61f3bcad4e1ce13d080b26249fb6accaa31bf650b820d5988de99c132570e09c03b19bbd74121f7f076af8f7b2f28
+  metadata.gz: e8e3b4ccb5793e85757223306b50afde56a28078ce28468baebd68e0a0dd302b5413afef0415d0679a5792c374521e5cf0a571f0399449399739dc312f6fd1a9
+  data.tar.gz: d68eadab213ce6003e64ad54495758a0cc5da87e0ae5ecf83c0587d097205488a386edc106e2f8da233870d79e5b1bd9f79c5c0555b18d289ac59f105dc2a47d

data/lib/stack-service-base/command_init.rb

@@ -6,12 +6,13 @@ SSBase::CommandLine::COMMANDS[:init] = Class.new do
     parser.on('', '--gitlab-c', 'Gitlab C CI/CD')
     parser.on('', '--gitlab',   'Gitlab CI/CD')
     parser.on('', '--github',   'GitHub CI/CD')
+    parser.on('', '--frontend', 'Vite frontend service')
   end
 
   def run(obj, params, args, _extra)
     if params.empty? || args.empty?
       puts 'Usage:'
-      puts "\tssbase init [option] <service name>"
+      puts "\tssbase init [--frontend] [option] <service name>"
       puts "\tssbase init stack [option]"
       puts 'option: --gitlab-c, --gitlab, --github'
       return
@@ -23,13 +24,14 @@ SSBase::CommandLine::COMMANDS[:init] = Class.new do
       type = :stack
       service_name = 'fake-service-name'
     else
-      type = :project
+      type = params[:frontend] ? :frontend : :project
       service_name = first_arg
     end
 
     copy_folder type, :home
 
-    copy_folder type, 'gitlab-c' if params[:gitlab_c]
+    default_platform = params.values_at(:gitlab_c, :gitlab, :github).none?
+    copy_folder type, 'gitlab-c' if params[:gitlab_c] || default_platform
     copy_folder type, 'gitlab' if params[:gitlab]
     copy_folder type, 'github' if params[:github]
 

data/lib/stack-service-base/frontend_template/github/.github/workflows/main.yml

@@ -0,0 +1,19 @@
+on: { push: { branches: [main,release] } }
+
+jobs:
+  build_service_images:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: docker/login-action@v2
+        with: { username: '${{ secrets.DOCKER_HUB_LOGIN }}', password: '${{ secrets.DOCKER_HUB_PASSWORD }}' }
+      - uses: docker/setup-buildx-action@v3
+      - uses: ruby/setup-ruby@v1
+        with: { ruby-version: 3.4.4 }
+      - run: gem install build-labels
+      - run: env && cd docker && build-labels -n -c docker-compose.yml $(if [ "${GITHUB_REF##*/}" = "release" ]; then echo "--full-version"; fi) github set_version to_dockerfiles to_compose | tee bake.yml
+        env:
+          GITHUB_RUN_NUMBER: ${{ github.run_number }}
+      - uses: docker/bake-action@v5
+        env: { REGISTRY_HOST: '${{ secrets.DOCKER_HUB_LOGIN }}' }
+        with: { workdir: ./docker, files: bake.yml, push: true }

data/lib/stack-service-base/frontend_template/github/docker/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  ${service_name}:
+    image: ${REGISTRY_HOST}/${service_name}
+    build:
+      context: ../src
+      additional_contexts:
+        docker: ../docker
+      dockerfile: ../docker/frontend/Dockerfile
+    ports:
+      - "7000:8080"
+    environment:
+      API_BASE_URL: ${API_BASE_URL:-}
+      BACKEND_URL: ${BACKEND_URL:-http://127.0.0.1:65535}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+      PATH_PREFIX: ${PATH_PREFIX:-}

data/lib/stack-service-base/frontend_template/gitlab/.gitlab-ci.yml

@@ -0,0 +1,48 @@
+stages:
+  - test
+  - build
+
+.build_block: &build_block
+#  tags: [ build ]
+  image: docker:27.5.1-cli
+  services:
+    - name: docker:27.5.1-dind
+      alias: docker
+  variables:
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+  script:
+    - export CI_COMMIT_TAG="${CI_COMMIT_TAG:-0.0.0}"
+    - |
+      if [ -n "${CI_REGISTRY:-}" ] && [ -n "${CI_REGISTRY_USER:-}" ] && [ -n "${CI_REGISTRY_PASSWORD:-}" ]; then
+        echo "${CI_REGISTRY_PASSWORD}" | docker login "${CI_REGISTRY}" -u "${CI_REGISTRY_USER}" --password-stdin
+      fi
+    - docker buildx create --name "${CI_PROJECT_NAME}-wrapper-builder" --driver docker-container --use || docker buildx use "${CI_PROJECT_NAME}-wrapper-builder"
+    - docker buildx inspect --bootstrap
+    - |
+      docker buildx build --load \
+        -t build/${CI_PROJECT_NAME} \
+        -f docker/Dockerfile.build \
+        --cache-from type=registry,ref=${CI_REGISTRY_IMAGE}/ci-wrapper:${CI_COMMIT_REF_SLUG}-cache \
+        --cache-to type=registry,ref=${CI_REGISTRY_IMAGE}/ci-wrapper:${CI_COMMIT_REF_SLUG}-cache,mode=max \
+        .
+    - docker run --rm `env | grep -o '^CI_[^=]*' | sed 's/^/-e /'`
+      -e REGISTRY_HOST=$CI_REGISTRY/$CI_PROJECT_NAMESPACE
+      -v /var/run/docker.sock:/var/run/docker.sock
+      -v /root/.docker:/root/.docker
+      build/${CI_PROJECT_NAME} 2>&1
+
+build push:
+  <<: *build_block
+  stage: build
+  needs: [ tests ]
+
+tests:
+  <<: *build_block
+  stage: test
+  variables:
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+    CI_SKIP_PUSH: true
+    # build-labels sets target for each service in docker-compose.yml
+    CI_BUILD_TARGET: tests

data/lib/stack-service-base/frontend_template/gitlab/docker/Dockerfile.build

@@ -0,0 +1,36 @@
+FROM ruby:3.4.4-slim-bookworm AS base
+RUN apt-get update && apt-get install -y --no-install-recommends bash ca-certificates curl git tar \
+    && rm -rf /var/lib/apt/lists/*
+RUN gem install build-labels:0.0.79
+RUN BUILDX_VERSION=v0.20.1 COMPOSE_VERSION=v2.33.0 install-docker-static 27.5.1
+
+WORKDIR /build
+
+COPY .. .
+
+CMD ["bash", "-euo", "pipefail", "-c", "\
+    cd /build/docker; \
+    if [ -n \"${CI_REGISTRY:-}\" ] && [ -n \"${CI_REGISTRY_USER:-}\" ] && [ -n \"${CI_REGISTRY_PASSWORD:-}\" ]; then \
+      echo \"$CI_REGISTRY_PASSWORD\" | docker login \"$CI_REGISTRY\" -u \"$CI_REGISTRY_USER\" --password-stdin; \
+    fi; \
+    build-labels -n -c docker-compose.yml changed gitlab set_version cache to_dockerfiles to_compose | tee bake.yml; \
+    export OTEL_RESOURCE_ATTRIBUTES=\"service.name=docker-builder,pipeline.id=${CI_PIPELINE_ID:-local},project.name=${service_name}\"; \
+    export REGISTRY_HOST=\"${REGISTRY_HOST:-${CI_REGISTRY_HOST:-${CI_REGISTRY_IMAGE:-}}}\"; \
+    : \"${REGISTRY_HOST:?REGISTRY_HOST, CI_REGISTRY_IMAGE, or CI_REGISTRY_HOST is required}\"; \
+    export BUILDX_BAKE_ENTITLEMENTS_FS=0; \
+    if grep -q \"services: {}\" bake.yml; then \
+      echo \"No changed services to build.\"; \
+      exit 0; \
+    fi; \
+    docker buildx create --name \"${service_name}-builder\" --driver docker-container --use || docker buildx use \"${service_name}-builder\"; \
+    docker buildx inspect --bootstrap; \
+    if [ -n \"${CI_SKIP_PUSH:-}\" ]; then \
+      docker buildx bake --load --allow=fs.read=../src -f bake.yml; \
+    else \
+      docker buildx bake --push --allow=fs.read=../src -f bake.yml; \
+    fi; \
+    if [ \"${CI_BUILD_TARGET:-}\" = \"tests\" ]; then \
+      docker compose -f bake.yml down --remove-orphans; \
+      docker compose -f bake.yml up --no-build --force-recreate --abort-on-container-failure; \
+    fi \
+    "]

data/lib/stack-service-base/frontend_template/gitlab/docker/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  ${service_name}:
+    image: ${REGISTRY_HOST}/${service_name}/${CI_COMMIT_REF_SLUG:-local}
+    build:
+      context: ../src
+      additional_contexts:
+        docker: ../docker
+      dockerfile: ../docker/frontend/Dockerfile
+    ports:
+      - "7000:8080"
+    environment:
+      API_BASE_URL: ${API_BASE_URL:-}
+      BACKEND_URL: ${BACKEND_URL:-http://127.0.0.1:65535}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+      PATH_PREFIX: ${PATH_PREFIX:-}

data/lib/stack-service-base/frontend_template/gitlab/docker/local_build.sh

@@ -0,0 +1,10 @@
+export CI_PROJECT_NAME=${service_name}
+export CI_PIPELINE_ID=local
+export CI_PIPELINE_IID=0
+export CI_REGISTRY_HOST=localhost
+export CI_SKIP_PUSH=true
+
+#  -v /root/.docker:/root/.docker \
+docker run --rm --env-file <(env | grep ^CI_) \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  $(docker build -q -t build/${CI_PROJECT_NAME} -f Dockerfile.build ..) 2>&1

data/lib/stack-service-base/frontend_template/gitlab-c/.gitlab-ci.yml

@@ -0,0 +1,24 @@
+stages:
+  - first
+
+.build_block: &build_block
+  stage: first
+  tags: [ build ]
+  needs: [ ]
+  image: docker:27.5.1
+  script:
+    - export CI_COMMIT_TAG="${CI_COMMIT_TAG:-0.0.0}"
+    - docker run --rm `env | grep -o '^CI_[^=]*' | sed 's/^/-e /'`
+      -v /var/run/docker.sock:/var/run/docker.sock
+      -v /root/.docker:/root/.docker
+      $(docker build -q -t build/${CI_PROJECT_NAME} -f docker/Dockerfile.build .) 2>&1
+
+build push:
+  <<: *build_block
+
+tests:
+  <<: *build_block
+  variables:
+    CI_SKIP_PUSH: true
+    # build-labels sets target for each service in docker-compose.yml
+    CI_BUILD_TARGET: tests

data/lib/stack-service-base/frontend_template/gitlab-c/docker/Dockerfile.build

@@ -0,0 +1,17 @@
+FROM ruby:3.4.4-slim-bookworm AS base
+RUN apt update && apt install -y --no-install-recommends bash git
+RUN gem install build-labels:0.0.79
+RUN BUILDX_VERSION=v0.20.1 COMPOSE_VERSION=v2.33.0 install-docker-static 27.5.1
+
+WORKDIR /build
+
+COPY . .
+
+CMD ["bash", "-c", "-x", "\
+    env && cd /build/docker && \
+    build-labels -n -c docker-compose.yml changed gitlab set_version to_dockerfiles to_compose | tee bake.yml && \
+    export OTEL_RESOURCE_ATTRIBUTES=service.name=docker-builder,pipeline.id=${CI_PIPELINE_ID},project.name=${CI_PROJECT_NAME} && \
+    export REGISTRY_HOST=$CI_REGISTRY_HOST &&  export BUILDX_BAKE_ENTITLEMENTS_FS=0 && \
+    grep \"services: {}\" bake.yml || docker buildx bake -f bake.yml $([ -z \"$CI_SKIP_PUSH\" ] && echo \"--push\") && \
+    ([ \"$CI_BUILD_TARGET\" = \"tests\" ] && (docker compose -f bake.yml down && docker compose -f bake.yml up --force-recreate ) || true) \
+    "]

data/lib/stack-service-base/frontend_template/gitlab-c/docker/docker-compose.yml

@@ -0,0 +1,15 @@
+services:
+  ${service_name}:
+    image: ${REGISTRY_HOST}/${service_name}/${CI_COMMIT_BRANCH}
+    build:
+      context: ../src
+      additional_contexts:
+        docker: ../docker
+      dockerfile: ../docker/frontend/Dockerfile
+    ports:
+      - "7000:8080"
+    environment:
+      API_BASE_URL: ${API_BASE_URL:-}
+      BACKEND_URL: ${BACKEND_URL:-http://127.0.0.1:65535}
+      LOG_LEVEL: ${LOG_LEVEL:-info}
+      PATH_PREFIX: ${PATH_PREFIX:-}

data/lib/stack-service-base/frontend_template/gitlab-c/docker/local_build.sh

@@ -0,0 +1,11 @@
+CI_PROJECT_NAME=${service_name}
+export CI_PIPELINE_ID=local
+export CI_PIPELINE_IID=0
+export CI_REGISTRY_HOST=localhost
+export CI_SKIP_PUSH=true
+
+#  -v /root/.docker:/root/.docker \
+docker run --rm --env-file <(env | grep ^CI_) \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  $(docker build -q -t build/${CI_PROJECT_NAME} -f Dockerfile.build ..) 2>&1
+

data/lib/stack-service-base/frontend_template/home/.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

data/lib/stack-service-base/frontend_template/home/.gitattributes

@@ -0,0 +1,4 @@
+* text=auto
+*.sh text eol=lf
+*.envsh text eol=lf
+*.template text eol=lf

data/lib/stack-service-base/frontend_template/home/.gitignore

@@ -0,0 +1,17 @@
+.idea/
+.vscode/
+.qodo
+.idea
+.codex
+.agents
+*/spec/results
+.env.local
+*/.env.*
+*.iml
+*.log
+src/.env.local
+src/node_modules/
+src/dist/
+src/coverage/
+src/test-results/
+src/playwright-report/

data/lib/stack-service-base/frontend_template/home/AGENTS.md

@@ -0,0 +1,3 @@
+
+Refer to ~/.codex/shared/AGENTS.md for the actual instructions.  
+Refer to ~/.codex/shared/skills for the list actual skills.

data/lib/stack-service-base/frontend_template/home/README.md

@@ -0,0 +1,68 @@
+# ${service_name}
+
+Framework-neutral frontend service starter for the corporate stack. It includes
+local development, checks, production build, nginx runtime, containers, and CI.
+Choose the UI framework, router, and domain structure, and adapt the supplied
+infrastructure to the service requirements.
+
+## Development
+
+Node.js 24 LTS is required for local development.
+
+    cd src
+    cp .env.example .env.local
+    npm ci
+    npm start
+
+The development server listens on http://localhost:3000. Set BACKEND_URL in
+.env.local to enable the same-origin /api proxy.
+
+Application code and tests may use JavaScript, TypeScript, or both. TypeScript
+remains strict; JavaScript requires no type annotations and is checked by ESLint.
+
+## Checks
+
+    cd src
+    npm test
+    npm run check
+
+`npm test` runs the tests. `npm run check` additionally runs TypeScript
+validation, ESLint, and a production build.
+
+Run a local production preview with:
+
+    npm run preview
+
+The preview command builds before serving. For a prefixed deployment, run
+`PATH_PREFIX=/example npm run preview` and open
+http://localhost:3000/example/.
+
+## Container
+
+    docker-compose -f docker/docker-compose.yml up --build
+
+The service is available at http://localhost:7000. nginx runs unprivileged on
+container port 8080, exposes /healthcheck, and supports PATH_PREFIX without
+rebuilding the image.
+
+PATH_PREFIX may be empty or contain letters, digits, `_`, `-`, and `/`.
+The complete prefixes `/api`, `/assets`, and `/healthcheck` are reserved.
+
+Browser-visible runtime configuration:
+
+- PATH_PREFIX
+- API_BASE_URL
+- LOG_LEVEL
+
+runtime-config.js is public; never put credentials or secrets into these values.
+BACKEND_URL is server-only and configures the nginx /api proxy.
+
+nginx uses a same-origin Content Security Policy. Extend the corresponding
+directive in `docker/frontend/nginx.conf.template` when external resources are
+required.
+
+## CI
+
+GitLab follows the same corporate `build-labels` orchestration as Ruby services.
+Ruby only runs that tool; the frontend is tested and built with Node and served
+by nginx at runtime.

data/lib/stack-service-base/frontend_template/home/docker/.env

@@ -0,0 +1,3 @@
+REGISTRY_HOST=127.0.0.1
+CI_COMMIT_BRANCH=local
+COMPOSE_PROJECT_NAME=${service_name}

data/lib/stack-service-base/frontend_template/home/docker/frontend/15-runtime-settings.envsh

@@ -0,0 +1,90 @@
+#!/bin/sh
+
+raw_path_prefix=$(printf '%s' "${PATH_PREFIX:-}" |
+  sed -E 's#^[[:space:]]+|[[:space:]]+$##g; s#^/+##; s#/+$##')
+
+case "$raw_path_prefix" in
+  '')
+    PATH_PREFIX=''
+    PATH_PREFIX_RULE=''
+    ;;
+  *[!A-Za-z0-9_/-]* | *'//'*)
+    echo "Invalid PATH_PREFIX: ${PATH_PREFIX:-}" >&2
+    exit 1
+    ;;
+  api | assets | healthcheck)
+    echo "PATH_PREFIX is reserved by the service runtime: /$raw_path_prefix" >&2
+    exit 1
+    ;;
+  *)
+    PATH_PREFIX="/$raw_path_prefix"
+    PATH_PREFIX_RULE=$(printf \
+      'location = %s { absolute_redirect off; return 308 %s/; }\n    location ^~ %s/ { rewrite ^%s/(.*)$ /$1 last; }' \
+      "$PATH_PREFIX" "$PATH_PREFIX" "$PATH_PREFIX" "$PATH_PREFIX")
+    ;;
+esac
+
+dns_resolver=${DNS_RESOLVER:-$(awk '$1 == "nameserver" { print $2; exit }' /etc/resolv.conf)}
+
+case "$dns_resolver" in
+  '' | *[!A-Fa-f0-9:.]*)
+    echo "Unable to determine a valid DNS resolver" >&2
+    exit 1
+    ;;
+esac
+
+DNS_RESOLVER=$dns_resolver
+
+backend_url=${BACKEND_URL:-http://127.0.0.1:65535}
+backend_url=${backend_url%/}
+
+case "$backend_url" in
+  http://* | https://*) ;;
+  *)
+    echo "BACKEND_URL must be an http or https origin" >&2
+    exit 1
+    ;;
+esac
+
+BACKEND_PROTO=${backend_url%%://*}
+backend_authority=${backend_url#*://}
+
+case "$backend_authority" in
+  '' | */* | *'?'* | *'#'* | *'@'*)
+    echo "BACKEND_URL must not contain credentials, query, fragment, or path" >&2
+    exit 1
+    ;;
+esac
+
+case "$backend_authority" in
+  *:*)
+    BACKEND_HOST=${backend_authority%%:*}
+    BACKEND_PORT=${backend_authority##*:}
+    ;;
+  *)
+    BACKEND_HOST=$backend_authority
+    if [ "$BACKEND_PROTO" = 'https' ]; then
+      BACKEND_PORT=443
+    else
+      BACKEND_PORT=80
+    fi
+    ;;
+esac
+
+case "$BACKEND_HOST" in
+  '' | *[!A-Za-z0-9_.-]*)
+    echo "BACKEND_URL contains an invalid host" >&2
+    exit 1
+    ;;
+esac
+
+case "$BACKEND_PORT" in
+  '' | *[!0-9]*)
+    echo "BACKEND_URL contains an invalid port" >&2
+    exit 1
+    ;;
+esac
+
+export PATH_PREFIX PATH_PREFIX_RULE DNS_RESOLVER BACKEND_PROTO BACKEND_HOST BACKEND_PORT
+
+unset raw_path_prefix dns_resolver backend_url backend_authority

data/lib/stack-service-base/frontend_template/home/docker/frontend/40-path-prefix-settings.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+compiled_app_dir=${COMPILED_APP_DIR:-/usr/share/nginx/html}
+placeholder='/__PATH_PREFIX__/'
+path_prefix=$(printf '%s' "${PATH_PREFIX:-}" |
+  sed -E 's#^[[:space:]]+|[[:space:]]+$##g; s#^/+##; s#/+$##')
+
+if [ -n "$path_prefix" ]; then
+  replacement="/$path_prefix/"
+else
+  replacement='/'
+fi
+
+escaped_replacement=$(printf '%s' "$replacement" | sed -e 's/[\\&|]/\\&/g')
+
+find "$compiled_app_dir" -type f \
+  \( -name '*.html' -o -name '*.js' -o -name '*.css' -o -name '*.map' \) -print |
+  while IFS= read -r file; do
+    if grep -q "$placeholder" "$file"; then
+      sed -i "s|$placeholder|$escaped_replacement|g" "$file"
+    fi
+  done
+
+if find "$compiled_app_dir" -type f \
+  \( -name '*.html' -o -name '*.js' -o -name '*.css' -o -name '*.map' \) \
+  -exec grep -q "$placeholder" {} \; -print | grep -q .; then
+  echo "PATH_PREFIX placeholder remains in compiled assets" >&2
+  exit 1
+fi

data/lib/stack-service-base/frontend_template/home/docker/frontend/45-runtime-config-settings.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+set -eu
+
+compiled_app_dir=${COMPILED_APP_DIR:-/usr/share/nginx/html}
+output="$compiled_app_dir/runtime-config.js"
+temporary_output="$output.tmp"
+path_prefix=$(printf '%s' "${PATH_PREFIX:-}" |
+  sed -E 's#^[[:space:]]+|[[:space:]]+$##g; s#^/+##; s#/+$##')
+
+if [ -n "$path_prefix" ]; then
+  path_prefix="/$path_prefix"
+fi
+
+{
+  printf 'window.__APP_CONFIG__ = '
+  jq -cn \
+    --arg pathPrefix "$path_prefix" \
+    --arg apiBaseUrl "${API_BASE_URL:-}" \
+    --arg logLevel "${LOG_LEVEL:-info}" \
+    '{PATH_PREFIX: $pathPrefix, API_BASE_URL: $apiBaseUrl, LOG_LEVEL: $logLevel}'
+  printf ';\n'
+} > "$temporary_output"
+
+mv "$temporary_output" "$output"

data/lib/stack-service-base/frontend_template/home/docker/frontend/Dockerfile

@@ -0,0 +1,46 @@
+FROM node:24.18-alpine AS base
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci
+
+COPY . .
+
+FROM base AS tests
+CMD ["npm", "run", "check"]
+
+FROM base AS build
+
+RUN npm run build
+
+FROM nginxinc/nginx-unprivileged:1.28.1-alpine AS deploy
+
+USER root
+RUN apk add --no-cache ca-certificates curl jq \
+    && rm -rf /usr/share/nginx/html/*
+
+ENV PORT=8080 \
+    NODE_ENV=production \
+    PATH_PREFIX= \
+    API_BASE_URL= \
+    LOG_LEVEL=info \
+    BACKEND_URL=http://127.0.0.1:65535
+
+COPY --from=docker /frontend/nginx.conf.template /etc/nginx/templates/default.conf.template
+COPY --chmod=755 --from=docker /frontend/15-runtime-settings.envsh /docker-entrypoint.d/
+COPY --chmod=755 --from=docker /frontend/40-path-prefix-settings.sh /docker-entrypoint.d/
+COPY --chmod=755 --from=docker /frontend/45-runtime-config-settings.sh /docker-entrypoint.d/
+RUN rm -f /etc/nginx/conf.d/default.conf \
+    && chown -R 101:101 /etc/nginx/conf.d /usr/share/nginx/html
+
+COPY --chown=101:101 --from=build /app/dist /usr/share/nginx/html
+
+USER 101:101
+
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=10s \
+  CMD curl -fsS "http://127.0.0.1:${PORT}/healthcheck" || exit 1
+
+EXPOSE 8080
+
+CMD ["nginx", "-g", "daemon off;"]

data/lib/stack-service-base/frontend_template/home/docker/frontend/nginx.conf.template

@@ -0,0 +1,75 @@
+server {
+    listen ${PORT};
+    server_name _;
+
+    resolver ${DNS_RESOLVER} valid=30s ipv6=off;
+    resolver_timeout 10s;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    gzip on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+
+    add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data: blob:; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self' blob:" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+
+    location = /healthcheck {
+        access_log off;
+        default_type application/json;
+        return 200 '{"Status":"Healthy"}';
+    }
+
+    location ^~ /api {
+        set $backend_origin "${BACKEND_PROTO}://${BACKEND_HOST}:${BACKEND_PORT}";
+
+        proxy_pass $backend_origin;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host ${BACKEND_HOST};
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_ssl_name ${BACKEND_HOST};
+        proxy_ssl_server_name on;
+        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+        proxy_ssl_verify on;
+        proxy_cookie_domain ~.* $host;
+        proxy_cookie_path / /;
+    }
+
+    location = /runtime-config.js {
+        expires -1;
+        add_header Cache-Control "no-store" always;
+        add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data: blob:; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self' blob:" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        try_files $uri =404;
+    }
+
+    location = /index.html {
+        expires -1;
+        add_header Cache-Control "no-store" always;
+        add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data: blob:; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'self' blob:" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        try_files $uri =404;
+    }
+
+    location /assets/ {
+        expires 1y;
+        try_files $uri =404;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    ${PATH_PREFIX_RULE}
+}

data/lib/stack-service-base/frontend_template/home/src/.dockerignore

@@ -0,0 +1,9 @@
+node_modules
+dist
+.env
+.env.*
+!.env.example
+*.log
+coverage
+test-results
+playwright-report