@venizia/ardor 0.4.1 → 0.4.2

package/dist/presets/app/files/.configs/builders/Dockerfile

@@ -60,8 +60,9 @@ ARG APP_BUILD_COMMIT=
 LABEL org.opencontainers.image.revision="${APP_BUILD_COMMIT}"
 
 # The base image's entrypoint turns every /etc/nginx/templates/*.template into /etc/nginx/conf.d/*,
-# replacing ${API_UPSTREAM} and leaving nginx's own variables ($uri, $host) as they are.
+# leaving nginx's own variables ($uri, $host) as they are. The template includes the two snippets below.
 COPY --from=builder /home/bun/app/{{appPath}}/.configs/builders/nginx.conf.template /etc/nginx/templates/default.conf.template
+COPY --from=builder /home/bun/app/{{appPath}}/.configs/builders/nginx-snippets /etc/nginx/snippets
 COPY --from=builder --chown=101:101 /home/bun/app/{{appPath}}/dist /usr/share/nginx/html
 
 # The runtime config: this script writes /usr/share/nginx/html/config.js from the VITE_ environment variables
@@ -69,7 +70,11 @@ COPY --from=builder --chown=101:101 /home/bun/app/{{appPath}}/dist /usr/share/ng
 # file it rewrites is the one the build copied from src/public, owned by 101 above.
 COPY --from=builder --chmod=0755 /home/bun/app/{{appPath}}/.configs/builders/docker-entrypoint.d/40-runtime-config.sh /docker-entrypoint.d/40-runtime-config.sh
 
-# Where /api goes: a compose service name, a cluster service, an address (an origin, with no path).
+# The /api proxy: this script writes it from snippets/api-proxy.conf when API_UPSTREAM is set and not empty.
+COPY --from=builder --chmod=0755 /home/bun/app/{{appPath}}/.configs/builders/docker-entrypoint.d/45-api-proxy.sh /docker-entrypoint.d/45-api-proxy.sh
+
+# Where /api goes: a compose service name, a cluster service, an address (an origin, with no path). An app
+# served behind a gateway sets it empty (`ENV API_UPSTREAM=` or `-e API_UPSTREAM=`), and then has no /api.
 ENV API_UPSTREAM=http://api:3000
 
 # The variables the app cannot run without, comma separated. A container that starts without one of them,

package/dist/presets/app/files/.configs/builders/docker-entrypoint.d/45-api-proxy.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Writes the /api proxy of nginx only when the container has an upstream: `docker run -e API_UPSTREAM=http://api:3000`.
+# With API_UPSTREAM unset or empty no /api location exists, which is what an app served behind a gateway wants.
+#
+# The nginx image runs every executable file of /docker-entrypoint.d/ in `sort -V` order before it starts nginx; the
+# 45 puts this after the runtime-config script. nginx.conf.template includes /etc/nginx/conf.d/*.locations, and a
+# glob that matches nothing is not an error. A script without the executable bit is skipped, hence `COPY --chmod=0755`
+# in the Dockerfile.
+#
+# The upstream is written into the nginx configuration, so it must be an address and nothing else: a value with a
+# character outside letters, digits, brackets (an IPv6 address) and `._:/@%+-` stops the container, naming the variable and never the value.
+#
+# API_PROXY_SOURCE and API_PROXY_TARGET name other files, for the tests; they are not VITE_ names, so never published.
+set -eu
+
+SOURCE="${API_PROXY_SOURCE:-/etc/nginx/snippets/api-proxy.conf}"
+TARGET="${API_PROXY_TARGET:-/etc/nginx/conf.d/api-proxy.locations}"
+
+# A file left from an earlier start must not outlive the variable that asked for it.
+rm -f "$TARGET"
+
+if [ -z "${API_UPSTREAM:-}" ]; then
+  echo "[api-proxy] API_UPSTREAM is empty: no /api proxy"
+  exit 0
+fi
+
+case "$API_UPSTREAM" in
+  *[!][A-Za-z0-9._:/@%+-]*)
+    echo "[api-proxy] FATAL: API_UPSTREAM has a character that is not part of an address" >&2
+    exit 1
+    ;;
+esac
+
+# Only these two: nginx's own variables ($api_upstream, $host) stay as they are.
+envsubst '${API_UPSTREAM} ${NGINX_LOCAL_RESOLVERS}' < "$SOURCE" > "$TARGET"
+echo "[api-proxy] /api goes to the upstream of API_UPSTREAM"

package/dist/presets/app/files/.configs/builders/nginx-snippets/api-proxy.conf

@@ -0,0 +1,14 @@
+# The /api proxy. The script 45-api-proxy.sh fills in the two variables API_UPSTREAM and NGINX_LOCAL_RESOLVERS and
+# writes the result to /etc/nginx/conf.d/api-proxy.locations, only when API_UPSTREAM is set and not empty.
+#
+# The path is kept: /api/hello reaches the upstream at /api/hello. The upstream is a variable that a resolver
+# looks up per request, so nginx starts when the host does not resolve yet and only /api answers 502 until it does.
+location /api/ {
+  resolver ${NGINX_LOCAL_RESOLVERS} valid=10s ipv6=off;
+  set $api_upstream ${API_UPSTREAM};
+  proxy_pass $api_upstream;
+  proxy_http_version 1.1;
+  proxy_set_header Host $host;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
+}

package/dist/presets/app/files/.configs/builders/nginx-snippets/security-headers.conf

@@ -0,0 +1,11 @@
+# The response headers of the app, included by every location of nginx.conf.template. `always` sends
+# them on error responses too.
+add_header X-Content-Type-Options "nosniff" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header X-Frame-Options "SAMEORIGIN" always;
+
+# A Content-Security-Policy depends on what the app loads, so none is sent. An example to adapt: start with
+# Content-Security-Policy-Report-Only, watch the browser console, then switch to the enforcing header. Admin
+# libraries often need 'unsafe-inline' for styles. `frame-ancestors` replaces X-Frame-Options where both exist.
+#
+# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;

package/dist/presets/app/files/.configs/builders/nginx.conf.template

@@ -1,5 +1,9 @@
-# The nginx configuration of {{app}}, rendered by the base image at start: ${API_UPSTREAM} and
-# ${NGINX_LOCAL_RESOLVERS} are the variables replaced; $uri and $host are nginx's own.
+# The nginx configuration of {{app}}, rendered by the base image at start. Its own variables ($uri,
+# $host) are nginx's, not the image's. Two things are included from /etc/nginx/snippets and
+# /etc/nginx/conf.d, both put there by the Dockerfile and the entrypoint script 45-api-proxy.sh:
+#
+#   security-headers.conf   the response headers every location sends
+#   *.locations             the /api proxy, written only when API_UPSTREAM is set and not empty
 server {
   listen 8080;
   server_name _;
@@ -7,22 +11,34 @@ server {
   root /usr/share/nginx/html;
   index index.html;
 
-  # The backend. The path is kept: /api/hello reaches ${API_UPSTREAM}/api/hello. The upstream is a
-  # variable that a resolver looks up per request, so nginx starts when the host does not resolve yet
-  # and only /api answers 502 until it does.
-  location /api/ {
-    resolver ${NGINX_LOCAL_RESOLVERS} valid=10s ipv6=off;
-    set $api_upstream ${API_UPSTREAM};
-    proxy_pass $api_upstream;
-    proxy_http_version 1.1;
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
+  # Text is compressed (html always is). Images and fonts are already compressed: leave them out.
+  gzip on;
+  gzip_vary on;
+  gzip_min_length 256;
+  gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/manifest+json application/xml image/svg+xml;
+
+  # nginx inherits add_header from the server only into a location that sets none of its own, and every
+  # location below sets Cache-Control. So each one includes the same snippet again: a header added to
+  # the snippet reaches all of them.
+  include /etc/nginx/snippets/security-headers.conf;
+
+  # For a load balancer or an orchestrator: answers from nginx alone, never from the backend.
+  location = /health {
+    access_log off;
+    default_type text/plain;
+    add_header Cache-Control "no-store";
+    include /etc/nginx/snippets/security-headers.conf;
+    return 200 "ok\n";
   }
 
+  # The backend, when API_UPSTREAM is set: /api/hello reaches the upstream at /api/hello. An app that is served
+  # behind a gateway leaves API_UPSTREAM empty, and no /api location exists. See snippets/api-proxy.conf.
+  include /etc/nginx/conf.d/*.locations;
+
   # The runtime config is written when the container starts and has no hash in its name: never cached.
   location = /config.js {
     add_header Cache-Control "no-store";
+    include /etc/nginx/snippets/security-headers.conf;
     try_files $uri =404;
   }
 
@@ -30,12 +46,14 @@ server {
   location /assets/ {
     expires 1y;
     add_header Cache-Control "public, immutable";
+    include /etc/nginx/snippets/security-headers.conf;
     try_files $uri =404;
   }
 
   # A route of the app, opened or reloaded directly, is served by the app.
   location / {
     add_header Cache-Control "no-cache";
+    include /etc/nginx/snippets/security-headers.conf;
     try_files $uri $uri/ /index.html;
   }
 }

package/dist/presets/app/preset.json

@@ -13,12 +13,12 @@
   "dependencies": {
     "@reduxjs/toolkit": "^2.13.0",
     "@tanstack/react-query": "^5.104.5",
-    "@venizia/ardor": "0.4.1",
-    "@venizia/ignis-connectors": "0.4.1",
-    "@venizia/ignis-filter": "0.4.1",
-    "@venizia/ignis-helpers": "0.4.1",
-    "@venizia/ignis-inversion": "0.4.1",
-    "@venizia/ignis-kernel": "0.4.1",
+    "@venizia/ardor": "0.4.2",
+    "@venizia/ignis-connectors": "0.4.2",
+    "@venizia/ignis-filter": "0.4.2",
+    "@venizia/ignis-helpers": "0.4.2",
+    "@venizia/ignis-inversion": "0.4.2",
+    "@venizia/ignis-kernel": "0.4.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "ra-core": "^5.15.5",
@@ -35,8 +35,8 @@
     "@types/bun": "^1.4.3",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "@venizia/dev-configs": "0.4.1",
-    "@venizia/ignis-boot": "0.4.1",
+    "@venizia/dev-configs": "0.4.2",
+    "@venizia/ignis-boot": "0.4.2",
     "@vitejs/plugin-react": "^6.1.2",
     "eslint": "^10.13.0",
     "oxlint": "1.89.0",

package/dist/presets/lib/preset.json

@@ -5,8 +5,8 @@
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@types/react": "^19",
-    "@venizia/ardor": "^0.4.1",
-    "@venizia/dev-configs": "0.4.1",
+    "@venizia/ardor": "^0.4.2",
+    "@venizia/dev-configs": "0.4.2",
     "eslint": "^10.13.0",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
@@ -17,7 +17,7 @@
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@venizia/ardor": "^0.4.1",
+    "@venizia/ardor": "^0.4.2",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "react-router-dom": "^7.18.4",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venizia/ardor",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "ARDOR - frontend application framework for the VENIZIA family. One entry point over ardor-kernel, ardor-react and ardor-admin: IGNIS inversion of control, a REST data layer, auth and i18n providers, and the React bindings for a react-admin application.",
   "keywords": [
     "ardor",
@@ -65,13 +65,13 @@
     "prepublishOnly": "make rebuild"
   },
   "dependencies": {
-    "@venizia/ardor-admin": "0.4.1",
-    "@venizia/ardor-kernel": "0.4.1",
-    "@venizia/ardor-react": "0.4.1"
+    "@venizia/ardor-admin": "0.4.2",
+    "@venizia/ardor-kernel": "0.4.2",
+    "@venizia/ardor-react": "0.4.2"
   },
   "devDependencies": {
     "@size-limit/preset-small-lib": "^14.2.0",
-    "@venizia/dev-configs": "^0.4.1",
+    "@venizia/dev-configs": "^0.4.2",
     "eslint": "^10.13.0",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",