From 52b8b46eebf0f2f1ccc2b147bdd86008a4353607 Mon Sep 17 00:00:00 2001
From: Joris Gallot <joris.gallot18@gmail.com>
Date: Wed, 10 Jun 2026 18:49:26 +0200
Subject: [PATCH] chore: add web dockerfile

---
 packages/server/src/lib/auth.ts  |  7 +++++++
 packages/server/src/lib/utils.ts |  2 +-
 packages/web/Dockerfile          | 22 ++++++++++++++++++++++
 packages/web/nginx.conf          | 29 +++++++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 packages/web/Dockerfile
 create mode 100644 packages/web/nginx.conf

diff --git a/packages/server/src/lib/auth.ts b/packages/server/src/lib/auth.ts
index b5d28d4..9d94881 100644
--- a/packages/server/src/lib/auth.ts
+++ b/packages/server/src/lib/auth.ts
@@ -24,6 +24,13 @@ export const auth = betterAuth({
   },
   // No SMTP yet: emails stay unverified, so apply the new address directly instead of mailing a verification link.
   user: { changeEmail: { enabled: true, updateEmailWithoutVerification: true } },
+  // Prod: share the session cookie across app.kinora.dev <-> api.kinora.dev
+  advanced: {
+    crossSubDomainCookies: {
+      enabled: env.NODE_ENV === 'production',
+      domain: '.kinora.dev',
+    },
+  },
   secret: env.AUTH_SECRET,
   plugins: [apiKey(), lastLoginMethod(), polarAuthPlugin()].filter(
     (plugin): plugin is NonNullable<typeof plugin> => plugin !== null,
diff --git a/packages/server/src/lib/utils.ts b/packages/server/src/lib/utils.ts
index 71fe26d..8afd17d 100644
--- a/packages/server/src/lib/utils.ts
+++ b/packages/server/src/lib/utils.ts
@@ -2,7 +2,7 @@ import { env } from './env'
 
 export function getTrustedOrigins(): string[] {
   const byEnv: Record<typeof env.NODE_ENV, string[]> = {
-    production: ['https://kinora.dev'],
+    production: ['https://app.kinora.dev'],
     development: ['http://localhost:5173'],
   }
   return byEnv[env.NODE_ENV]
diff --git a/packages/web/Dockerfile b/packages/web/Dockerfile
new file mode 100644
index 0000000..355d73d
--- /dev/null
+++ b/packages/web/Dockerfile
@@ -0,0 +1,22 @@
+# Frontend image: web dashboard (SPA at /) + trace viewer (static at /trace).
+# Build from the REPO ROOT (pnpm workspace):
+#   docker build -f packages/web/Dockerfile \
+#     --build-arg VITE_KINORA_SERVER_URL=https://api.kinora.dev -t kinora-web .
+FROM node:24-alpine AS build
+RUN npm i -g corepack@latest && corepack enable
+WORKDIR /repo
+
+# Baked at build time (Vite). VITE_KINORA_VIEWER_URL defaults to /trace/ (same origin).
+ARG VITE_KINORA_SERVER_URL
+ENV VITE_KINORA_SERVER_URL=$VITE_KINORA_SERVER_URL
+
+COPY . .
+RUN pnpm install --frozen-lockfile --filter @kinora/web... --filter @kinora/trace-viewer...
+RUN pnpm --filter @kinora/web build
+RUN pnpm --filter @kinora/trace-viewer build
+
+FROM nginx:1.27-alpine AS runtime
+COPY packages/web/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /repo/packages/web/dist /usr/share/nginx/html
+COPY --from=build /repo/packages/trace-viewer/dist /usr/share/nginx/html/trace
+EXPOSE 80
diff --git a/packages/web/nginx.conf b/packages/web/nginx.conf
new file mode 100644
index 0000000..fc8c2a8
--- /dev/null
+++ b/packages/web/nginx.conf
@@ -0,0 +1,29 @@
+server {
+  listen 80;
+  server_name _;
+
+  # Bare /trace -> /trace/ (the viewer is served with base /trace/).
+  location = /trace {
+    return 301 /trace/;
+  }
+
+  # Embedded trace viewer (built with base /trace/: its own index, assets, sw).
+  location /trace/ {
+    root /usr/share/nginx/html;
+    try_files $uri $uri/ /trace/index.html;
+  }
+
+  # Web hashed assets - immutable, long cache.
+  location /assets/ {
+    root /usr/share/nginx/html;
+    try_files $uri =404;
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+  }
+
+  # Web SPA - vue-router history fallback.
+  location / {
+    root /usr/share/nginx/html;
+    try_files $uri $uri/ /index.html;
+  }
+}