webmail-client/docker/Dockerfile.frontend

# Production web image: the built SPA served by nginx, which also reverse-proxies
# /api (including the /api/ws WebSocket) to the API container. Build context is
# the REPO ROOT so the build stage can see frontend/.
#
#   docker build -f docker/Dockerfile.frontend -t webmail/web .

# ---------- builder -----------------------------------------------------------
FROM node:20-slim AS builder

WORKDIR /src
COPY frontend/package.json frontend/package-lock.json* ./
# `npm ci` when a lockfile is present (reproducible), `npm install` otherwise.
RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi

COPY frontend/ ./
# Type-check + bundle. `npm run build` runs `tsc --noEmit && vite build`, so a
# type error fails the image build rather than shipping a broken bundle.
RUN npm run build

# ---------- runtime -----------------------------------------------------------
FROM nginx:1.27-alpine

ARG APP_VERSION=dev
ARG GIT_SHA=unknown
LABEL org.opencontainers.image.title="webmail-web" \
      org.opencontainers.image.version="${APP_VERSION}" \
      org.opencontainers.image.revision="${GIT_SHA}"

COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
# Shared server body, included by both listeners. Outside conf.d/ so nginx
# does not try to load it as a config of its own.
COPY docker/nginx-app.conf /etc/nginx/webmail-app.conf
COPY docker/nginx-security.conf /etc/nginx/webmail-security.conf
COPY --from=builder /src/dist /usr/share/nginx/html

# Surface the running version to `deploy/webmail.sh status` without needing the API.
RUN printf '%s\n' "${APP_VERSION}" > /usr/share/nginx/html/version.txt

# 80 = public mail, 81 = admin (see docker/nginx.conf).
EXPOSE 80 81