kawa
ebda614aaa
Two deployment-breaking issues caused 404s on protected pages after a container recreate: 1. DataProtection keys were stored in the container's ephemeral home dir. Every redeploy regenerated them, invalidating all auth cookies (users silently logged out) and — worse — making the app-only certs encrypted under /data/appcerts undecryptable. Persist keys to /data/dpkeys with a stable application name so they survive recreates. 2. DefaultChallengeScheme was OpenIdConnect, so a logged-out request to any [Authorize] Blazor page forced an OIDC challenge. When OIDC is unconfigured/unreachable the challenge throws and the request 404s, with no path to the login page. Challenge the cookie scheme instead, which redirects to /account/login (the combined local + Microsoft page). OIDC is still triggered explicitly from /account/login/entra. Also harden the container image: - Pin base images to exact patch (sdk:10.0.300, aspnet:10.0.8). Floating :10.0 tags drift; a stale/pre-GA SDK base silently drops blazor.web.js from the publish manifest, 404ing framework assets in production. - Install curl and switch the compose healthcheck to it (the aspnet image ships no wget/curl, so the old healthcheck always reported unhealthy). Probe /account/login (anonymous, 200) since / now 302-redirects. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
30 lines
976 B
Docker
30 lines
976 B
Docker
# Base images pinned to exact patch for reproducible builds. Floating `:10.0` tags
|
|
# drift; a stale/pre-GA SDK base silently drops the Blazor framework static assets
|
|
# (blazor.web.js) from the publish manifest → 404 in production. Bump deliberately.
|
|
FROM mcr.microsoft.com/dotnet/aspnet:10.0.8 AS base
|
|
WORKDIR /app
|
|
EXPOSE 8080
|
|
# curl for the compose healthcheck (aspnet image ships no wget/curl).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
FROM mcr.microsoft.com/dotnet/sdk:10.0.300 AS build
|
|
WORKDIR /src
|
|
COPY ["SharepointToolbox.Web.csproj", "."]
|
|
RUN dotnet restore
|
|
COPY . .
|
|
RUN dotnet publish -c Release -o /app/publish --no-restore
|
|
|
|
FROM base AS final
|
|
WORKDIR /app
|
|
COPY --from=build /app/publish .
|
|
|
|
# Volume for persistent data (profiles, settings, templates, logs, exports)
|
|
VOLUME ["/data"]
|
|
|
|
ENV ASPNETCORE_URLS=http://+:8080
|
|
ENV DataFolder=/data
|
|
|
|
ENTRYPOINT ["dotnet", "SharepointToolbox.Web.dll"]
|