jacobh2
50a0d6792a
Build Kvitt images / build (push) Failing after 1m20s
Part A (D-132): KVITT_WEB_DIR (default /app) served under /app/ by a small handler: /app redirects to /app/, app routes fall back to index.html, a missing assets/* file is 404, assets cached immutable, index.html no-store, the app's own CSP plus nosniff, DENY and no-referrer. Unsafe paths never reach the file system. /app paths count against the unauthenticated per-IP limit. Without the directory every /app path stays 404 not_found. server/Dockerfile gains a Node 24 LTS stage (pinned by digest) building web/, passed through the Rust stage so npm and rustc never run at once on the Pi 3; the build context is the repository root with an allowlist .dockerignore (server/.dockerignore removed); workflow, build-images.sh and infra/dev/build.sh follow. Part B (D-133): GET /analytics/trends (E-34) and GET /analytics/forecast (E-35), authenticated, read-only, SQL month buckets; rules (half-up average, trailing 3-month moving average, percent against the rounded average, template occurrence per month) in kvitt-domain::analytics. OpenAPI, examples, contracts-check and tests updated (35 operations). Cargo.lock: rustls-webpki 0.103.16 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0382, -0383) so that cargo audit passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
39 lines
1.5 KiB
Bash
Executable File
39 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Builds the development images on this Mac (native linux/arm64, nothing pushed):
|
|
# kvitt-server:dev from server/Dockerfile (context: the repository root, D-132: it builds web/ too)
|
|
# kvitt-backup:dev from infra/backup/Dockerfile
|
|
# Usage: infra/dev/build.sh [server|backup|all] (default: all)
|
|
# Refuses to run while a Gradle build holds the gradle-serial lock (CLAUDE.md: never build images during a Gradle build).
|
|
set -euo pipefail
|
|
# shellcheck source=lib.sh
|
|
. "$(dirname "$0")/lib.sh"
|
|
# shellcheck source=../../tools/gradle-lock.sh
|
|
. "$repo_root/tools/gradle-lock.sh"
|
|
|
|
what="${1:-all}"
|
|
if pid="$(gradle_lock_holder)"; then
|
|
die "a Gradle build is running (pid $pid, $KVITT_GRADLE_LOCK); try again when it is done."
|
|
fi
|
|
|
|
server_image="$(env_value KVITT_SERVER_IMAGE kvitt-server:dev)"
|
|
backup_image="$(env_value KVITT_BACKUP_IMAGE kvitt-backup:dev)"
|
|
|
|
build_server() {
|
|
local dockerfile="$repo_root/server/Dockerfile"
|
|
local context="${KVITT_SERVER_BUILD_CONTEXT:-$repo_root}"
|
|
echo "Building $server_image from server/Dockerfile"
|
|
docker build --platform linux/arm64 -f "$dockerfile" -t "$server_image" "$context"
|
|
}
|
|
|
|
build_backup() {
|
|
echo "Building $backup_image from infra/backup/Dockerfile"
|
|
docker build --platform linux/arm64 -f "$repo_root/infra/backup/Dockerfile" -t "$backup_image" "$repo_root/infra/backup"
|
|
}
|
|
|
|
case "$what" in
|
|
server) build_server ;;
|
|
backup) build_backup ;;
|
|
all) build_backup; build_server ;;
|
|
*) echo "usage: $0 [server|backup|all]" >&2; exit 2 ;;
|
|
esac
|