argoyleandClaude Opus 5.5
1646ee1bc3
The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se context on the runners). Deploys now go to the Frostmoln production cluster (namespace schemas), the way the sites do. Frostmoln enforces restricted Pod Security: the pod runs as the image's non-root user with a matching securityContext. The prod-only manifests move to the prod-frostmoln target; the ALB ingress becomes a Traefik one with a Let's Encrypt certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
22 lines
865 B
Docker
22 lines
865 B
Docker
FROM cypress/base:26.0.0@sha256:446be8fcb63e3cad2f9a4e14720e3d8e35993e12f36da541e09f5740a4c2477c as builder
|
|
WORKDIR /build
|
|
|
|
RUN npm install --global node-gyp && \
|
|
git config --global --add safe.directory /build
|
|
|
|
COPY ./package.json ./package-lock.json ./
|
|
RUN npm ci --no-progress
|
|
COPY . /build
|
|
RUN npm run postinstall && npm run generate && npm run lint && npm run test:coverage
|
|
|
|
FROM scratch as export
|
|
COPY --from=builder /build/coverage /
|
|
|
|
# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
|
|
FROM nginxinc/nginx-unprivileged:1.31.6@sha256:1d26a516fb93b18f9c0214dc9c645054486e516f13ff09ef63d5bd5c622278a2
|
|
MAINTAINER Joakim Olsson <joakim@unbound.se>
|
|
|
|
COPY ./nginx/nginx.conf /etc/nginx/nginx.conf
|
|
COPY ./nginx/security_headers.conf /etc/nginx/security_headers.conf
|
|
COPY --from=builder /build/.output/public/ /usr/share/nginx/html/
|