Rebuild on the Bennett platform: Spring Boot + Vite/React

Same site — glass header, bento grid, hero drift, dark mode — with three things fixed on the way: - Tailwind and lucide came from CDNs on every page load, and the fonts from Google. All are now built in or self-hosted, so the site owes nothing to third parties at runtime. - The hero and bento photographs were hot-linked from Unsplash. They are re-encoded to webp and served from the MinIO bucket with a year-long cache. - The ministries and labs were hard-coded in the markup, so launching a ministry meant editing HTML. They now come from /api/network. The mobile menu button also opens something now; it did nothing before. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01XXKjx7FNyRVAjU8dgB5KhN
2026-07-23 07:30:01 -05:00
parent f2be8ce247
commit 8abca06a86
33 changed files with 2551 additions and 323 deletions
@@ -1,5 +1,37 @@
 # syntax=docker/dockerfile:1
-FROM nginx:1.27-alpine
-COPY . /usr/share/nginx/html/
-RUN rm -f /usr/share/nginx/html/README.md /usr/share/nginx/html/Dockerfile /usr/share/nginx/html/.dockerignore
-EXPOSE 80
+
+# ---------- build ----------
+FROM maven:3.9-eclipse-temurin-25 AS build
+WORKDIR /src
+COPY . .
+# Resolve the platform from the Gitea Maven registry (creds via BuildKit secrets); the Maven build also
+# runs the Vite/React SPA build (frontend-maven-plugin) and folds it into the jar. Tests are skipped here
+# because Testcontainers needs a Docker daemon — they run via `mvn verify`, not in the image build.
+RUN --mount=type=secret,id=maven_user --mount=type=secret,id=maven_token \
+    MAVEN_USER="$(cat /run/secrets/maven_user)" MAVEN_TOKEN="$(cat /run/secrets/maven_token)" \
+    mvn -B -ntp -s .gitea/ci-settings.xml -DskipTests package \
+ && cp "$(ls target/rwn-website-*.jar | grep -v original | head -1)" app.jar \
+ && java -Djarmode=tools -jar app.jar extract --layers --destination extracted
+
+# ---------- runtime ----------
+FROM eclipse-temurin:25-jre-alpine AS runtime
+RUN apk -U upgrade --no-cache && apk add --no-cache curl
+RUN addgroup -S spring && adduser -S -D -H -h /app -s /sbin/nologin -G spring spring
+WORKDIR /app
+
+COPY --from=build --chown=spring:spring /src/extracted/dependencies/ ./
+COPY --from=build --chown=spring:spring /src/extracted/snapshot-dependencies/ ./
+COPY --from=build --chown=spring:spring /src/extracted/application/ ./
+
+USER spring
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
+  CMD curl -fsS http://localhost:8080/actuator/health || exit 1
+
+ARG GIT_SHA=unknown
+LABEL org.opencontainers.image.title="rwn-website" \
+      org.opencontainers.image.source="https://git.thebennett.net/reformedwitness/rwn-website" \
+      org.opencontainers.image.revision="${GIT_SHA}"
+
+ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75.0", "-jar", "app.jar"]