From 0452d1f921341ef29743a038d94e3450b9e60a6a Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sat, 15 Aug 2026 17:46:27 -0700 Subject: [PATCH] Fix web/Dockerfile dropping two of its three VITE_* build args MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only VITE_API_BASE_URL had a matching ARG/ENV pair; docker-compose.yml's build args for VITE_ALERTING_API_BASE_URL and VITE_ENTERPRISE_AUTH_BASE_URL were silently dropped by Docker (an undeclared --build-arg is dropped, not an error). enterpriseAuthBase came out undefined in the built bundle, so the tenant-picker page threw "enterprise-auth is not configured" against a real running container even though docker-compose.yml looked correct. The other two vars masked this because web/src/lib/api.ts's apiBase/alertingBase both have hardcoded fallbacks that happen to match the intended values. Found while wiring a real Auth0 developer tenant into enterprise-auth to close §3a/§12's remaining "real external IdP" gap. Also gitignores docker-compose.override.yml, since that's where such real credentials belong for local testing -- never committed. --- .gitignore | 4 ++++ web/Dockerfile | 19 ++++++++++++++++--- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 6a79b6e..d6646e8 100644 --- a/.gitignore +++ b/.gitignore @@ -22,6 +22,10 @@ web/.svelte-kit/ # Dev-only generated secrets hack/dev-certs/out/ +# Local overrides that may carry real credentials (e.g. a real OIDC/SAML +# dev-tenant client secret for manual SSO testing) -- never committed. +docker-compose.override.yml + # OS / editor .DS_Store Thumbs.db diff --git a/web/Dockerfile b/web/Dockerfile index a3b96f5..e84f4a7 100644 --- a/web/Dockerfile +++ b/web/Dockerfile @@ -7,11 +7,24 @@ WORKDIR /src COPY package.json package-lock.json ./ RUN npm ci COPY . . -# VITE_API_BASE_URL is baked in at build time — this is a prerendered -# static site, not a server. Override with --build-arg for non-default -# deployments. +# All three VITE_* vars are baked in at build time — this is a +# prerendered static site, not a server. Override with --build-arg for +# non-default deployments. Each one needs its own ARG: an undeclared +# --build-arg from docker-compose.yml's build.args is silently dropped +# by Docker, not an error -- confirmed the hard way when +# VITE_ALERTING_API_BASE_URL/VITE_ENTERPRISE_AUTH_BASE_URL were being +# passed in but only VITE_API_BASE_URL was ever declared here, so the +# other two never reached `npm run build` even though docker-compose.yml +# looked correct. VITE_ENTERPRISE_AUTH_BASE_URL has no default (unlike +# the other two) -- web/src/lib/api.ts treats it as intentionally +# undefined when unset, meaning "enterprise-auth isn't deployed", not +# "use some fallback host." ARG VITE_API_BASE_URL=http://localhost:8080 +ARG VITE_ALERTING_API_BASE_URL=http://localhost:8081 +ARG VITE_ENTERPRISE_AUTH_BASE_URL ENV VITE_API_BASE_URL=${VITE_API_BASE_URL} +ENV VITE_ALERTING_API_BASE_URL=${VITE_ALERTING_API_BASE_URL} +ENV VITE_ENTERPRISE_AUTH_BASE_URL=${VITE_ENTERPRISE_AUTH_BASE_URL} RUN npm run build # Not distroless: serving a static SPA needs *some* HTTP server, and