chore: add web dockerfile

packages/server/src/lib/auth.ts

@@ -24,6 +24,13 @@ export const auth = betterAuth({
   },
   // No SMTP yet: emails stay unverified, so apply the new address directly instead of mailing a verification link.
   user: { changeEmail: { enabled: true, updateEmailWithoutVerification: true } },
+  // Prod: share the session cookie across app.kinora.dev <-> api.kinora.dev
+  advanced: {
+    crossSubDomainCookies: {
+      enabled: env.NODE_ENV === 'production',
+      domain: '.kinora.dev',
+    },
+  },
   secret: env.AUTH_SECRET,
   plugins: [apiKey(), lastLoginMethod(), polarAuthPlugin()].filter(
     (plugin): plugin is NonNullable<typeof plugin> => plugin !== null,

packages/server/src/lib/utils.ts

@@ -2,7 +2,7 @@ import { env } from './env'
 
 export function getTrustedOrigins(): string[] {
   const byEnv: Record<typeof env.NODE_ENV, string[]> = {
-    production: ['https://kinora.dev'],
+    production: ['https://app.kinora.dev'],
     development: ['http://localhost:5173'],
   }
   return byEnv[env.NODE_ENV]

packages/web/Dockerfile

@@ -0,0 +1,22 @@
+# Frontend image: web dashboard (SPA at /) + trace viewer (static at /trace).
+# Build from the REPO ROOT (pnpm workspace):
+#   docker build -f packages/web/Dockerfile \
+#     --build-arg VITE_KINORA_SERVER_URL=https://api.kinora.dev -t kinora-web .
+FROM node:24-alpine AS build
+RUN npm i -g corepack@latest && corepack enable
+WORKDIR /repo
+
+# Baked at build time (Vite). VITE_KINORA_VIEWER_URL defaults to /trace/ (same origin).
+ARG VITE_KINORA_SERVER_URL
+ENV VITE_KINORA_SERVER_URL=$VITE_KINORA_SERVER_URL
+
+COPY . .
+RUN pnpm install --frozen-lockfile --filter @kinora/web... --filter @kinora/trace-viewer...
+RUN pnpm --filter @kinora/web build
+RUN pnpm --filter @kinora/trace-viewer build
+
+FROM nginx:1.27-alpine AS runtime
+COPY packages/web/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /repo/packages/web/dist /usr/share/nginx/html
+COPY --from=build /repo/packages/trace-viewer/dist /usr/share/nginx/html/trace
+EXPOSE 80

packages/web/nginx.conf

@@ -0,0 +1,29 @@
+server {
+  listen 80;
+  server_name _;
+
+  # Bare /trace -> /trace/ (the viewer is served with base /trace/).
+  location = /trace {
+    return 301 /trace/;
+  }
+
+  # Embedded trace viewer (built with base /trace/: its own index, assets, sw).
+  location /trace/ {
+    root /usr/share/nginx/html;
+    try_files $uri $uri/ /trace/index.html;
+  }
+
+  # Web hashed assets - immutable, long cache.
+  location /assets/ {
+    root /usr/share/nginx/html;
+    try_files $uri =404;
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+  }
+
+  # Web SPA - vue-router history fallback.
+  location / {
+    root /usr/share/nginx/html;
+    try_files $uri $uri/ /index.html;
+  }
+}