feat: docker & build

dockerfiles/Dockerfile.dev

@@ -0,0 +1,23 @@
+# syntax=docker/dockerfile:1
+# DEV image: source bind-mounted by compose, rsbuild dev server with HMR.
+# node_modules lives in a named volume (see compose) so the host dir never
+# shadows the container install. Build context = mcma-webui/.
+FROM node:22-slim
+
+# `modern-sk` is a git dependency (git+https://...) — npm needs git to fetch it.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY package.json package-lock.json modern-sk-*.tgz ./
+RUN npm ci
+
+COPY . .
+
+EXPOSE 3000
+
+# host 0.0.0.0 + HMR client port come from env (RSBUILD_* in compose).
+# `--open` is dropped on purpose: no browser in a container.
+CMD ["npx", "rsbuild", "dev"]

dockerfiles/Dockerfile.prod

@@ -0,0 +1,29 @@
+# syntax=docker/dockerfile:1
+# PROD image: build static SPA, serve with nginx. Self-contained.
+# Build context = mcma-webui/. The future prod compose puts a real proxy in
+# front; this image just serves the built assets with SPA fallback.
+
+# -- build stage ----------------------------------------------------------
+FROM node:22-slim AS build
+
+WORKDIR /app
+
+COPY package.json package-lock.json modern-sk-*.tgz ./
+RUN npm ci
+
+COPY . .
+
+# Bake the API base URL at build time (rsbuild inlines PUBLIC_* vars).
+# Same-origin default ('/api/v1') works behind any reverse proxy.
+ARG PUBLIC_API_BASE_URL=/api/v1
+ENV PUBLIC_API_BASE_URL=$PUBLIC_API_BASE_URL
+RUN npm run build
+
+# -- runtime stage --------------------------------------------------------
+FROM nginx:1.27-alpine AS runtime
+
+COPY dockerfiles/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/dist /usr/share/nginx/html
+
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]

dockerfiles/nginx.conf

@@ -0,0 +1,21 @@
+# Static SPA server baked into the webui PROD image (Dockerfile.prod).
+# Only serves the built assets + SPA fallback. API routing belongs to the
+# outer reverse proxy in the future prod compose.
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Long-cache hashed build assets.
+    location /static/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+
+    # SPA: every unknown path falls back to index.html (client-side router).
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}