Вход из браузера: учитывать X-Forwarded-* — за Caddy свой домен считался чужим для CORS (403)

α Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'Вход без всплывающего окна браузера (Basic) — на форму входа при 401' (#5 ) from fix/no-basic-auth-popup into master
2026-11-05 15:43:10 +01:00 · 2026-11-05 15:34:40 +01:00 · 2026-11-05 15:34:32 +01:00 · 2026-11-05 14:36:58 +01:00
2 changed files with 10 additions and 5 deletions
@@ -1,7 +1,9 @@
 # Build context: repository root (docker compose: context ".", dockerfile backend/Dockerfile)
+# No Alpine images: on Jambotron staging VMs (kernel 6.18.55-virt) binaries from Alpine 3.24.3
+# (musl 1.2.6) die with "Bus error" — java survived, curl in the healthcheck did not (2026-11-05)

 # 1. Web client (Angular) — served by the backend from classpath:/static
-FROM node:22-alpine AS web
+FROM node:22-bookworm-slim AS web
 WORKDIR /web
 COPY frontend/package*.json ./
 RUN npm install --no-audit --no-fund
@@ -9,7 +11,7 @@ COPY frontend/ ./
 RUN npx ng build --configuration=production

 # 2. Backend
-FROM eclipse-temurin:21-jdk-alpine AS build
+FROM eclipse-temurin:21-jdk AS build
 WORKDIR /app
 COPY gradlew settings.gradle ./
 COPY gradle gradle
@@ -19,9 +21,9 @@ COPY --from=web /web/dist/frontend/browser backend/src/main/resources/static
 RUN chmod +x gradlew && ./gradlew :backend:bootJar --no-daemon -x test

 # 3. Runtime: not root; data in /app/data (volume)
-FROM eclipse-temurin:21-jre-alpine
-# own user: "mail" already exists in Alpine (uid 8, group 12) — addgroup mail fails
-RUN apk add --no-cache curl && addgroup -S -g 10001 app && adduser -S -u 10001 -G app app \
+FROM eclipse-temurin:21-jre
+# Ubuntu image, curl included; own user: "mail" already exists (uid 8)
+RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -d /app -s /usr/sbin/nologin app \
    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R app:app /app/data
 WORKDIR /app
 COPY --from=build /app/backend/build/libs/*.jar app.jar
@@ -1,5 +1,8 @@
 spring.application.name=mail-server
 server.port=8080
+# behind a proxy (Jambotron Caddy): take scheme/host from X-Forwarded-*, otherwise the browser's own
+# domain looks like another origin to CORS and every API call with an Origin header gets 403
+server.forward-headers-strategy=framework

 # Secrets: environment variables, or files in a config tree (file name = variable name, e.g. /run/mail-secrets/DB_PASSWORD).
 # No defaults — the server does not start without them (dev profile: application-dev.properties).
Author	SHA1	Message	Date
Liosha84	be6fed4986	Вход из браузера: учитывать X-Forwarded-* — за Caddy свой домен считался чужим для CORS (403) α Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 15:43:10 +01:00
Liosha84	44e2ced266	Merge pull request 'Вход без всплывающего окна браузера (Basic) — на форму входа при 401' (#5 ) from fix/no-basic-auth-popup into master Reviewed-on: #5	2026-11-05 15:34:40 +01:00
Liosha84	e54e140046	Merge pull request 'Dockerfile без Alpine — curl в healthcheck падал на ВМ staging' (#4 ) from fix/no-alpine-runtime into master Reviewed-on: #4	2026-11-05 15:34:32 +01:00
Liosha84	fdd6b8a51f	Dockerfile без Alpine: на ВМ staging бинарники Alpine 3.24.3 падают (Bus error), curl в healthcheck тоже α Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 14:36:58 +01:00