From aa546235fb42748fff318cce441a5c876310c686 Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Tue, 23 Jun 2026 19:15:44 +0200 Subject: [PATCH] =?UTF-8?q?docs(wiki):=20container-deployment=20=E2=80=94?= =?UTF-8?q?=20relative=20/api=20+=20Caddy=20proxy=20web-access=20section?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- wiki/decisions/container-deployment.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/wiki/decisions/container-deployment.md b/wiki/decisions/container-deployment.md index 5a8b3ca..94c3562 100644 --- a/wiki/decisions/container-deployment.md +++ b/wiki/decisions/container-deployment.md @@ -72,6 +72,21 @@ The **desktop** app stays on its own tag-only `release.yml` (Tauri installers), THEN run `python -c "from fast_alpr import ALPR; ALPR()"` so weights land in `/home/vision/.cache` — exactly where the runtime reads. Verify the boot log shows NO "Downloading …onnx". +## Web access — relative API + Caddy proxy (2026-06-23) + +- **The server-image SPA uses a RELATIVE `/api` base** (no baked origin), so the UI works loaded + from any hostname/IP. The Dockerfile empties `VITE_API_BASE` via `apps/web/.env.production.local` + before the web build — because Vite auto-loads `apps/web/.env.production`, which sets + `VITE_API_BASE=http://127.0.0.1:3000` for the **Tauri desktop** build only. Without the override + the browser bundle baked `127.0.0.1:3000` and failed Same-Origin Policy from any other host. **Do + NOT bake the domain via a build var** — relative means naming is controlled by hosts/DNS at deploy, + never a rebuild. +- **A Caddy reverse proxy** (prod override) publishes `:80` → `server:3000` (server is `expose`-only, + internal); `/api/ws` upgrades pass through. `Caddyfile` binds `:80` so it matches ANY host — booth + IP, localhost, or `parksystems.msai.al` (pointed at the booth IP via hosts/DNS on-site). TLS later: + swap `:80` for the real hostname + uncomment Caddy `:443` → auto-HTTPS. +- `WS_ALLOWED_ORIGINS` (env) must list any REMOTE origin admins use (same-origin always passes). + ## Invariants (must hold) - **Never bake the live DB.** `.dockerignore` excludes `**/parking.sqlite*` (incl. `-wal`/`-shm`/