jcoffey-dev
93d0a32af2
`BASE_PATH=/mail` mounts the whole app under a prefix, for a host that is not
ihasmail's alone. Unset -- every deployment that exists -- is the domain root
and is byte-for-byte what it was: the canonical form of the setting is the
empty string, and `""` concatenated onto `/api/health` is `/api/health`.
That choice of canonical form is the whole design. A trailing slash would have
been the obvious alternative, and it fails quietly in exactly one place: at the
root it makes `//api/health`, which is not a path on this host but a
protocol-relative URL to a host called `api`. One call site forgetting to
branch is a request leaving the origin. So the empty string, one leading slash,
no trailing one, worked out once in `scripts/basePath.mjs` -- plain JS, next to
`version.mjs`, because the web build and the server both have to reach the same
answer and two implementations of "what does /mail/ mean" is precisely the bug
where the server serves an app whose script tags point somewhere else.
`/mail`, `mail`, `/mail/` and `//mail//` all mean the same mount; a deployment
should not fail over a trailing slash.
Unlike everything else ihasmail is told, this one cannot wait for the process
to start. The bundle writes its own asset URLs into index.html, so `BASE_PATH`
is read at build time for Vite's `base` as well as at run time for the routes,
and the Dockerfile carries one value into both. Get them out of step and the
page comes up blank with a 404 in a console nobody has open -- so the static
handler, which is reading index.html anyway, checks what it asks for and says
so in the log once per build.
Everything moves together. The API mounts at `${base}/api`; the router is
given the base once, so every `<Route path>` and `<Link href>` stays written
root-absolute and wouter does the rest; `apiFetch` adds the prefix in one place
rather than at forty call sites; the session cookie's Path narrows to the mount
so two instances on one host cannot sign each other out.
Two things need no prefix at all, and it is worth saying why they were not
given one. A manifest's members resolve against the manifest's own address, so
relative URLs there follow the mount with nothing substituted at build time --
which is also why `public/` needed no template step. The service worker is the
same trick: it is served from the mount, so `new URL("./", self.location)`
tells it where that is, and a worker that derives the value cannot disagree
with the page that registered it.
Anything outside the mount is a 404 rather than the app shell, and
`stripBasePath` does not use `startsWith` -- under `/mail` this process shares
a hostname, and answering `/mailbox` with our index would shadow a neighbour
instead of letting it 404 honestly. For the same reason the notification-click
handler now checks the path as well as the origin: `includeUncontrolled` widens
`matchAll` to the whole origin, which off the root would have navigated a
stranger's tab to our inbox.
Inline images in a draft were the one silent trap. They are matched by their
blob URL on the way out, once unanchored and once anchored, and a bare
`/api/blob/` still appears inside `/mail/api/blob/...` -- so one pattern would
have replaced the tail and left `/mail` in front of a `cid:`, and the other
would have missed and sent the message linking to the sender's own webmail.
Both patterns are built from the base now.
72 lines
3.4 KiB
Docker
72 lines
3.4 KiB
Docker
# ---- build stage ----
|
|
FROM node:22-alpine AS build
|
|
# What this build calls itself: 2.16.<PR>, worked out by whoever runs the
|
|
# build. It cannot be worked out in here -- .dockerignore keeps .git out of the
|
|
# context on purpose, and git is not installed either. `node scripts/version.mjs`
|
|
# in a checkout prints the right answer; ihasmail-deploy.sh passes it through.
|
|
# Left empty, the build falls back to the base version from package.json.
|
|
ARG IHASMAIL_VERSION=""
|
|
ENV IHASMAIL_VERSION=$IHASMAIL_VERSION
|
|
# The subpath the app will be served from, e.g. /mail. Empty -- the default --
|
|
# is the domain root and is what every deployment gets unless it asks
|
|
# otherwise. Unlike the rest of ihasmail's configuration this cannot wait for
|
|
# the process to start: the web build writes its own asset URLs into
|
|
# index.html, so a build that does not know the prefix produces a shell that
|
|
# cannot load itself under one. It is therefore a build argument here and an
|
|
# environment variable in the runtime stage, from the same value.
|
|
ARG BASE_PATH=""
|
|
ENV BASE_PATH=$BASE_PATH
|
|
WORKDIR /app
|
|
COPY package.json package-lock.json* ./
|
|
COPY server/package.json server/
|
|
COPY web/package.json web/
|
|
RUN npm ci --ignore-scripts
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# ---- runtime stage ----
|
|
FROM node:22-alpine AS runtime
|
|
# Re-declared: an ARG does not cross stages.
|
|
ARG IHASMAIL_VERSION=""
|
|
ARG BASE_PATH=""
|
|
ENV NODE_ENV=production \
|
|
HOST=0.0.0.0 \
|
|
PORT=8080 \
|
|
STATIC_DIR=/app/web/dist \
|
|
SESSION_FILE=/data/sessions.json \
|
|
IHASMAIL_VERSION=$IHASMAIL_VERSION \
|
|
BASE_PATH=$BASE_PATH
|
|
WORKDIR /app
|
|
COPY package.json ./
|
|
COPY server/package.json server/
|
|
# config.ts reads the version through this at startup. With IHASMAIL_VERSION
|
|
# set it never looks further; without it, it falls back to package.json rather
|
|
# than failing, since there is no git in here to ask.
|
|
COPY scripts/ ./scripts/
|
|
COPY --from=build /app/node_modules ./node_modules
|
|
COPY --from=build /app/server/dist ./server/dist
|
|
COPY --from=build /app/web/dist ./web/dist
|
|
RUN mkdir -p /data && chown -R node:node /data /app
|
|
USER node
|
|
# No `VOLUME ["/data"]`. It reads like documentation for where the session file
|
|
# goes, but Docker acts on it: a container started without `-v` gets an
|
|
# anonymous volume mounted there anyway, and that mount stays writable even
|
|
# under `--read-only`. So the directive quietly put a writable hole in a
|
|
# container meant to be immutable, and left an orphaned volume behind every
|
|
# time one was replaced -- while never persisting anything across a redeploy,
|
|
# since each new container got a fresh empty volume of its own. Deployments
|
|
# that want the sessions to survive say so themselves: docker-compose.yml and
|
|
# deploy.example.sh both mount a *named* volume at /data, which is unaffected.
|
|
EXPOSE 8080
|
|
# Shell form, so $BASE_PATH is expanded by the container rather than baked in
|
|
# empty at build time: the health endpoint moves with the mount.
|
|
#
|
|
# The two substitutions repeat, in sh, what scripts/basePath.mjs does in
|
|
# JavaScript -- drop a trailing slash, add a leading one -- because this runs
|
|
# before there is a Node process to ask. It is worth the duplication: an
|
|
# operator who writes BASE_PATH=mail/ gets a working server, and without this
|
|
# a healthcheck that says the working server is unhealthy and has Docker
|
|
# restart it forever.
|
|
HEALTHCHECK --interval=30s --timeout=5s CMD BP="${BASE_PATH%/}"; case "$BP" in ""|/*) ;; *) BP="/$BP";; esac; wget -qO- "http://127.0.0.1:8080$BP/api/health" || exit 1
|
|
CMD ["node", "server/dist/index.js"]
|