psa-systems/mokosh-apps
Watch
9
0
Fork
You've already forked mokosh-apps
 0
Code Issues Pull requests 1 Projects Releases 14 Packages Wiki Activity Actions

feat(oci): runtime config injection via entrypoint #21

Merged
nrupard merged 1 commit from feat/runtime-config-injection into main 2026-05-15 17:32:38 +02:00
Conversation 0 Commits 1 Files changed 7 +189 -34
nrupard commented 2026-05-15 17:32:30 +02:00
Owner
Copy link

Lets self-hosters point the SPA at their own API + OIDC issuer without rebuilding the image. The container entrypoint generates /usr/share/caddy/_mokosh_config.js at start from env vars (MOKOSH_API_BASE, MOKOSH_OIDC_ISSUER, MOKOSH_OIDC_CLIENT_ID, MOKOSH_HUB_BASE_URL), injects a

Lets self-hosters point the SPA at their own API + OIDC issuer without rebuilding the image. The container entrypoint generates /usr/share/caddy/_mokosh_config.js at start from env vars (MOKOSH_API_BASE, MOKOSH_OIDC_ISSUER, MOKOSH_OIDC_CLIENT_ID, MOKOSH_HUB_BASE_URL), injects a <script> tag into index.html on first run, then execs Caddy. The SPA reads window.__MOKOSH_CONFIG__ first; if a field is absent it falls through to the existing msp.<tld> host-prefix derivation, then to the compile-time option_env! defaults. In dev (no entrypoint, no window global) every reader returns None so behaviour is unchanged. The Caddyfile no-cache rule was extended to cover /_mokosh_config.js so operator changes take effect on container restart. The Caddyfile COPY's previous --chmod=0644 was reverted because BuildKit propagates that mode to implicitly-created parent dirs (the /etc/caddy dir would land at 0644 with no execute bit, blocking appuser from traversing it); an explicit `RUN mkdir --parents /etc/caddy` is now done up front. Smoke-tested: container with no env exposes window.__MOKOSH_CONFIG__ = {}; container with all four env vars set exposes the matching fields; restarting with a different MOKOSH_API_BASE updates the served JS on the next request. Signed-off-by: nrupard <natrsmith11@gmail.com>
feat(oci): runtime config injection via entrypoint
Some checks failed
Check / clippy + fmt + tests (pull_request) Failing after 3s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
0bbf267d23 
Lets self-hosters point the SPA at their own API + OIDC issuer without rebuilding the image. The container entrypoint generates /usr/share/caddy/_mokosh_config.js at start from env vars (MOKOSH_API_BASE, MOKOSH_OIDC_ISSUER, MOKOSH_OIDC_CLIENT_ID, MOKOSH_HUB_BASE_URL), injects a <script> tag into index.html on first run, then execs Caddy. The SPA reads window.__MOKOSH_CONFIG__ first; if a field is absent it falls through to the existing msp.<tld> host-prefix derivation, then to the compile-time option_env! defaults. In dev (no entrypoint, no window global) every reader returns None so behaviour is unchanged. The Caddyfile no-cache rule was extended to cover /_mokosh_config.js so operator changes take effect on container restart. The Caddyfile COPY's previous --chmod=0644 was reverted because BuildKit propagates that mode to implicitly-created parent dirs (the /etc/caddy dir would land at 0644 with no execute bit, blocking appuser from traversing it); an explicit `RUN mkdir --parents /etc/caddy` is now done up front. Smoke-tested: container with no env exposes window.__MOKOSH_CONFIG__ = {}; container with all four env vars set exposes the matching fields; restarting with a different MOKOSH_API_BASE updates the served JS on the next request.

Signed-off-by: nrupard <natrsmith11@gmail.com>
nrupard deleted branch feat/runtime-config-injection 2026-05-15 17:32:38 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-apps!21
No description provided.