76af3156fa
api.yokogawa.tech has a public A record but no pinpoint record on the DC, so it does not resolve from inside the VNet at all. The browser called it by hostname, which means an operator on cicore1 would have loaded the page and had every question fail on DNS - the exact gap Phase 7's gate exists to catch, and one an engineer's laptop cannot see. Caddy now routes /ask under ai.yokogawa.tech to ai-api, inside a route block so import authelia still runs first: forward_auth sorts after handle in the default directive order, and outside a route the handles would be terminal and the gate would never run. Only /ask is routed - the Phase 9 publisher rule is scoped to api.yokogawa.tech and a wider route here would leave it inert. Also fixes the fallback it replaces. The build arg defaults to "", and `?? "https://api.yokogawa.tech"` does not catch an empty string, so the documented real-deployment build resolved the API base to "" and posted /ask at ai-web, which 404s it. verify.sh and deploy.sh now check both the route and whether the built bundle carries the hostname. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
21 lines
677 B
Docker
21 lines
677 B
Docker
# ai-web — node build, nginx serve.
|
|
FROM node:22-alpine AS build
|
|
WORKDIR /app
|
|
COPY package.json ./
|
|
RUN npm install
|
|
COPY . .
|
|
|
|
# Where the browser should send /ask. Empty - the default - means same-origin:
|
|
# Caddy routes /ask under ai.yokogawa.tech to ai-api, so no hostname is baked
|
|
# into the bundle at all. A tunnelled demo build overrides it:
|
|
# --build-arg VITE_API_BASE=http://localhost:8001
|
|
# Vite inlines this at BUILD time, so a change needs a rebuild, not a restart.
|
|
ARG VITE_API_BASE=""
|
|
ENV VITE_API_BASE=$VITE_API_BASE
|
|
|
|
RUN npm run build
|
|
|
|
FROM nginx:alpine
|
|
COPY --from=build /app/dist /usr/share/nginx/html
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
EXPOSE 80
|