fix(deploy): support isolated temporary production release

.dockerignore

@@ -8,3 +8,6 @@
 !unpackage/dist/build/
 !unpackage/dist/build/web/
 !unpackage/dist/build/web/**
+
+!deploy/Dockerfile.h5.production
+!deploy/nginx.production.conf.template

deploy/Dockerfile.h5.production

@@ -0,0 +1,5 @@
+ARG NGINX_BASE_IMAGE=nginx:1.27-alpine
+FROM ${NGINX_BASE_IMAGE}
+COPY deploy/nginx.production.conf.template /etc/nginx/templates/default.conf.template
+COPY unpackage/dist/build/web/ /srv/pda-h5/
+EXPOSE 80

deploy/docker-compose.h5.production.yml

@@ -0,0 +1,29 @@
+name: firstleg-production-pda-domestic-h5
+services:
+  pda-domestic-h5:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.h5.production
+      args:
+        NGINX_BASE_IMAGE: "${NGINX_BASE_IMAGE:-nginx:1.27-alpine}"
+    image: pda-domestic-h5-prod:${IMAGE_TAG:?IMAGE_TAG is required}
+    container_name: pda-domestic-h5-prod
+    restart: unless-stopped
+    environment:
+      API_UPSTREAM: "http://gateway:9000"
+    ports:
+      - "127.0.0.1:${HOST_PORT:-29005}:80"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO /dev/null http://127.0.0.1/healthz && wget -qO /dev/null http://127.0.0.1/"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 5s
+    networks:
+      backend:
+        aliases:
+          - pda-domestic-h5-prod
+networks:
+  backend:
+    external: true
+    name: firstleg-production-network

deploy/nginx.production.conf.template

@@ -0,0 +1,25 @@
+server {
+    listen 80;
+    server_name _;
+    root /srv/pda-h5;
+
+    location = /healthz {
+        default_type text/plain;
+        add_header Cache-Control "no-store" always;
+        return 200 "ok\n";
+    }
+    location /gateway-api/ {
+        client_max_body_size 55m;
+        proxy_pass ${API_UPSTREAM}/api/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $proxy_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+    location / {
+        index index.html;
+        try_files $uri $uri/ =404;
+        add_header Cache-Control "no-store" always;
+    }
+}

tests/h5-deployment.test.mjs

@@ -72,3 +72,15 @@ test('H5 proxy uses the shared gateway prefix and preserves API suffixes', async
     assert.equal(proxy['/gateway-api'].rewrite(`/gateway-api${suffix}`), `/api${suffix}`)
   }
 })
+
+test('gray H5 runs on an isolated network with same-origin Gateway API', async () => {
+  const compose = await read('../deploy/docker-compose.h5.production.yml')
+  const nginx = await read('../deploy/nginx.production.conf.template')
+  const docker = await read('../deploy/Dockerfile.h5.production')
+  assert.match(compose, /name: firstleg-production-network/)
+  assert.match(compose, /127\.0\.0\.1:/)
+  assert.doesNotMatch(compose, /test-network|gateway-overseas/)
+  assert.match(nginx, /location \/gateway-api\//)
+  assert.ok(nginx.includes('proxy_pass ${API_UPSTREAM}/api/;'))
+  assert.match(docker, /COPY deploy\/nginx.production.conf.template \/etc\/nginx\/templates\/default.conf.template/)
+})