Feature/docker ssl network

.dockerignore

@@ -1,7 +1,14 @@
 .git
 .github
+.vscode
+dashboard/dist
+dashboard/node_modules
+dashboard/.vite
+# Generated TLS assets (*.pem, *.key, san.cnf, ...).
+docker/nginx/tls/*
+!docker/nginx/tls/.gitkeep
 docs
-scripts
+.env
+.env.*
 node_modules
-dashboard/node_modules
-dashboard/dist
+scripts

.github/CODEOWNERS

@@ -5,4 +5,4 @@
 # Do not edit unless specifically mandated to do so.
 
 # Global/fallback and technical modifications.
-*   @SimonPinches @olivhoenen @prasad-sawantdesai
+*   @SimonPinches @olivhoenen @prasad-sawantdesai @Louwrensth

.github/workflows/node.js.yml → .github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
       uses: docker/setup-buildx-action@v4
 
     # APP_VERSION is embedded into the static assets at build time
-    - name: Build build target image
+    - name: Build build image
       uses: docker/build-push-action@v7
       with:
         target: build
@@ -115,7 +115,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     permissions:
-      contents: read
+      contents: write
       packages: write
     steps:
     - name: Lowercase repo-owner
@@ -128,6 +128,12 @@ jobs:
         name: simdb-dashboard-service
         path: ${{ runner.temp }}
 
+    - name: Download dist artifact
+      uses: actions/download-artifact@v8
+      with:
+        name: simdb-dashboard-dist
+        path: ${{ runner.temp }}/dist
+
     - name: Load service image
       run: docker load -i "${{ runner.temp }}/simdb-dashboard-service.tar"
 
@@ -138,11 +144,29 @@ jobs:
         username: ${{ steps.repo_owner.outputs.value }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
-    - name: Tag service image for registry
+    - name: Tag and push service image with version tag
       run: |
         docker tag \
           simdb-dashboard:service \
-          ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-dashboard:service-${{ needs.build.outputs.version }}
+          ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-dashboard:${{ needs.build.outputs.version }}
+        docker push ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-dashboard:${{ needs.build.outputs.version }}
 
-    - name: Push service image
-      run: docker push ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-dashboard:service-${{ needs.build.outputs.version }}
+    # These steps run on tagged commits only — `:latest` tag and GitHub Release.
+    - name: Tag and push latest
+      if: ${{ github.ref_type == 'tag' }}
+      run: |
+        docker tag \
+          simdb-dashboard:service \
+          ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-dashboard:latest
+        docker push ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-dashboard:latest
+
+    - name: Package and upload release tarball
+      if: ${{ github.ref_type == 'tag' }}
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        tar -czf "${{ runner.temp }}/simdb-dashboard-dist.tar.gz" \
+          -C "${{ runner.temp }}/dist" .
+        gh release create "${{ needs.build.outputs.version }}" \
+          "${{ runner.temp }}/simdb-dashboard-dist.tar.gz" \
+          --generate-notes

.gitignore

@@ -1,4 +1,13 @@
-dist/
+.idea/
 dashboard/dist/
 dashboard/node_modules/
-.idea/
+# Generated TLS assets (*.pem, *.key, san.cnf, ...).
+docker/nginx/tls/*
+!docker/nginx/tls/.gitkeep
+# Generated CA / server certificate build dir (scripts/certs/Makefile).
+scripts/certs/*.key
+scripts/certs/*.pem
+scripts/certs/*.csr
+scripts/certs/*.srl
+scripts/certs/san.cnf
+dist/

Dockerfile

@@ -24,17 +24,21 @@ ARG APP_VERSION=0.0.0-unknown
 ENV SIMDB_SERVER_URL=/scenarios/api \
     API_HOST=host.docker.internal \
     API_PORT=5000 \
-    DASHBOARD_PORT=80
+    SERVER_CONF=server-http.conf
 LABEL org.opencontainers.image.title="SimDB Dashboard" \
       org.opencontainers.image.description="Web frontend for the SimDB simulation management tool" \
       org.opencontainers.image.source="https://github.com/iterorganization/SimDB-Dashboard" \
       org.opencontainers.image.licenses="LGPL-3.0-only" \
       org.opencontainers.image.version="${APP_VERSION}" \
       io.simdb.component="dashboard"
-COPY docker/dashboard.nginx /etc/nginx/templates/default.conf.template
-COPY docker/runtime-config-template.js /usr/share/nginx/html/runtime-config-template.js
+COPY docker/nginx/templates/ /etc/nginx/templates/
+COPY docker/nginx/entrypoint/ /docker-entrypoint.d/
+COPY docker/nginx/tls/ /etc/nginx/tls/
+RUN chmod +x /docker-entrypoint.d/*.sh
 # App expects itself at urlpath /dashboard
 COPY --from=build /app/dist /usr/share/nginx/html/dashboard
 # NOTE: nginx base image already exposes port 80:
 EXPOSE 80
+# HTTPS service at port 443 (only utilized when SERVER_CONF=server-https.conf)
+EXPOSE 443
 CMD ["nginx", "-g", "daemon off;"]

Makefile

@@ -2,25 +2,40 @@ SHELL := /bin/sh
 
 VERSION ?= $(shell git describe --tags --always 2>/dev/null || echo 0.0.0-unknown)
 DASHBOARD_PORT ?= 80
-COMPOSE_PROJECT_NAME ?= simdb-dashboard-$(DASHBOARD_PORT)
+PROJECT_NAME ?= simdb-dashboard
+COMPOSE_PROJECT_NAME ?= $(PROJECT_NAME)-$(DASHBOARD_PORT)
 
+ifeq ($(USE_HTTPS),1)
+DASHBOARD_HTTPS_PORT ?= 443
+export DASHBOARD_HTTPS_PORT
+COMPOSE_FILE ?= docker-compose.yml:docker-compose.https.yml
+else
+COMPOSE_FILE ?= docker-compose.yml
+endif
+
+# Used by docker-compose
 export DASHBOARD_PORT
 export COMPOSE_PROJECT_NAME
 
 DOCKER_CMD ?= docker
 DOCKER_BUILD ?= $(DOCKER_CMD) build --build-arg APP_VERSION="$(VERSION)"
-DOCKER_COMPOSE ?= APP_VERSION="$(VERSION)" $(DOCKER_CMD) compose
+DOCKER_COMPOSE ?= APP_VERSION="$(VERSION)" COMPOSE_FILE="$(COMPOSE_FILE)" $(DOCKER_CMD) compose
+
+# systemd-install destinations
+package_optdir ?= /opt/$(PROJECT_NAME)
+package_etcdir ?= /etc/$(PROJECT_NAME)
+systemd_unitdir ?= /etc/systemd/system
 
-BUILD_IMAGE := simdb-dashboard:build
 DEV_IMAGE := simdb-dashboard:dev
+BUILD_IMAGE := simdb-dashboard:build
 SERVICE_IMAGE := simdb-dashboard:service
 
 .DEFAULT_GOAL := service
 
 .PHONY: \
 	build \
 	builder \
-	clean-images \
+	certs \
 	deploy \
 	dev \
 	dist \
@@ -33,6 +48,15 @@ SERVICE_IMAGE := simdb-dashboard:service
 	logs-f \
 	service \
 	shell \
+	systemd-disable \
+	systemd-daemon-reload \
+	systemd-enable \
+	systemd-installdirs \
+	systemd-install \
+	systemd-status \
+	systemd-start \
+	systemd-stop \
+	systemd-uninstall \
 	test \
 	type-check \
 	up \
@@ -52,6 +76,14 @@ help:
 	@echo "  make logs-f          Follow logs of the started simdb-dashboard service"
 	@echo "  make shell           Enter shell in the started simdb-dashboard service"
 	@echo ""
+	@echo "HTTPS toggle (set USE_HTTPS=1):"
+	@echo "  make certs                 Generate + install CA-signed TLS certs into docker/nginx/tls"
+	@echo "  USE_HTTPS=1 make service   Build HTTPS service stage and tag simdb-dashboard:service-https"
+	@echo "  USE_HTTPS=1 make up        Start dashboard with docker-compose.https.yml override"
+	@echo "  USE_HTTPS=1 make down      Stop dashboard started with the HTTPS compose override"
+	@echo "  USE_HTTPS=1 make logs-f    Follow logs of the HTTPS compose service"
+	@echo "  USE_HTTPS=1 make shell     Enter shell in the started HTTPS compose service"
+	@echo ""
 	@echo "Dockerfile stage targets:"
 	@echo "  make builder         Build builder stage (dependency setup + source prep)"
 	@echo "  make build           Build application build stage and tag $(BUILD_IMAGE)"
@@ -71,9 +103,25 @@ help:
 	@echo "  make distclean       Remove local artifacts and compose runtime state"
 	@echo "  make deploy          Deploy project (placeholder)"
 	@echo ""
+	@echo "Systemd integration (run with sudo):"
+	@echo "  sudo make systemd-install           Copy files to $(package_optdir) and $(package_etcdir)"
+	@echo "  sudo make systemd-enable            systemctl daemon-reload && systemctl enable simdb-dashboard"
+	@echo "  sudo make systemd-start             systemctl start  simdb-dashboard"
+	@echo "  sudo make systemd-status            systemctl status simdb-dashboard"
+	@echo "  sudo make systemd-stop              systemctl stop   simdb-dashboard"
+	@echo "  sudo make systemd-disable           systemctl stop && systemctl disable simdb-dashboard"
+	@echo "  sudo make systemd-uninstall         Remove files installed by systemd-install"
+	@echo "  USE_HTTPS=1 sudo make systemd-install          Include HTTPS compose override and TLS setup"
+	@echo ""
 	@echo "Environment variable examples:"
 	@echo "  Start simdb-dashboard at alternative DASHBOARD_PORT, with simdb server at API_PORT:"
 	@echo "    DASHBOARD_PORT=8080 API_PORT=5100 make up"
+	@echo "  Start HTTPS dashboard with alternative HTTP/HTTPS host ports:"
+	@echo "    DASHBOARD_PORT=8080 DASHBOARD_HTTPS_PORT=8443 USE_HTTPS=1 make up"
+
+# Generate and install CA-signed TLS certificates (scripts/certs/Makefile).
+certs:
+	$(MAKE) -C scripts/certs install
 
 # Compose targets
 up:
@@ -141,6 +189,10 @@ simdb-dashboard-service.tar: service
 	@echo "To load and run the image:"
 	@echo "  docker load -i simdb-dashboard-service.tar"
 	@echo "  docker run --rm -p 8080:80 --add-host host.docker.internal:host-gateway simdb-dashboard:service"
+	@echo "To load and run the local image via the systemd service:"
+	@echo "  sudo make systemd-install systemd-enable  # if not already done"
+	@echo "  docker load -i simdb-dashboard-service.tar  # Loaded image: simdb-dashboard:service"
+	@echo "  sudo vim /etc/simdb-dashboard/simdb-dashboard.env  # update SIMDB_DASHBOARD_IMAGE=simdb-dashboard SIMDB_DASHBOARD_TAG=service"
 
 update-base:
 	$(DOCKER_BUILD) --no-cache --pull --target service -t $(SERVICE_IMAGE) .
@@ -153,11 +205,73 @@ dashboard/package-lock.json: dashboard/package.json
 		"npm install --package-lock-only && npm audit fix && npm list"
 
 distclean:
-	$(DOCKER_COMPOSE) down --volumes --remove-orphans --rmi local
-	$(DOCKER_CMD) rmi -f $(BUILD_IMAGE) $(SERVICE_IMAGE) >/dev/null 2>&1 || true
+	APP_VERSION="$(VERSION)" COMPOSE_FILE="docker-compose.yml" $(DOCKER_CMD) compose down --volumes --remove-orphans --rmi local
+	APP_VERSION="$(VERSION)" COMPOSE_FILE="docker-compose.yml:docker-compose.https.yml" $(DOCKER_CMD) compose down --volumes --remove-orphans --rmi local
+	$(DOCKER_CMD) rmi -f $(BUILD_IMAGE) simdb-dashboard:service simdb-dashboard:service-https >/dev/null 2>&1 || true
 	$(DOCKER_CMD) volume rm -f simdb_dashboard_node_modules >/dev/null 2>&1 || true
 	rm -rf dist
 
+# Systemd integration (run with sudo)
+systemd-installdirs:
+	mkdir -p \
+		$(DESTDIR)/$(package_etcdir) \
+		$(DESTDIR)/$(package_optdir) \
+		$(DESTDIR)/$(package_optdir)/docker/nginx/tls/ \
+		$(DESTDIR)/$(package_optdir)/docker/nginx/templates/snippets \
+		$(DESTDIR)/$(systemd_unitdir)
+
+systemd-install: systemd-installdirs
+	install -m 644 \
+		docker-compose.https.yml \
+		docker-compose.systemd.yml \
+		docker-compose.yml \
+		$(DESTDIR)/$(package_optdir)
+	ls docker/nginx/tls/*.key 2>/dev/null && \
+		install -m 600 \
+		docker/nginx/tls/*.key \
+		$(DESTDIR)/$(package_optdir)/docker/nginx/tls/ || \
+		echo "WARNING: Could not install missing cert files, see docker/nginx/tls/*"
+	ls docker/nginx/tls/*.pem 2>/dev/null && \
+		install -m 644 \
+		docker/nginx/tls/*.pem \
+		$(DESTDIR)/$(package_optdir)/docker/nginx/tls/ || \
+		echo "WARNING: Could not install missing cert files, see docker/nginx/tls/*"
+	install -m 644 \
+		docker/nginx/templates/default.conf.template \
+		$(DESTDIR)/$(package_optdir)/docker/nginx/templates/
+	install -m 644 \
+		docker/nginx/templates/snippets/location-dashboard.conf.template \
+		docker/nginx/templates/snippets/location-simdb_proxy.conf.template \
+		docker/nginx/templates/snippets/runtime-config-template.js \
+		docker/nginx/templates/snippets/server-http.conf.template \
+		docker/nginx/templates/snippets/server-https.conf.template \
+		$(DESTDIR)/$(package_optdir)/docker/nginx/templates/snippets
+	install -m 644 \
+		scripts/simdb-dashboard.env.example \
+		$(DESTDIR)/$(package_etcdir)/simdb-dashboard.env.example
+	cd $(DESTDIR)/$(package_etcdir) && \
+		[ ! -f simdb-dashboard.env ] && \
+		install -m 644 simdb-dashboard.env.example simdb-dashboard.env || \
+		true
+	install -m 644 \
+		scripts/simdb-dashboard.service \
+		$(DESTDIR)/$(systemd_unitdir)/simdb-dashboard.service
+
+systemd-uninstall:
+	-rm -f --interactive $(DESTDIR)/$(systemd_unitdir)/simdb-dashboard.service
+	-rm -rf --interactive $(DESTDIR)/$(package_etcdir)
+	-rm -rf --interactive $(DESTDIR)/$(package_optdir)
+
+systemd-daemon-reload:
+	systemctl daemon-reload
+
+systemd-enable: systemd-daemon-reload
+
+systemd-disable: systemd-stop
+
+systemd-start systemd-status systemd-stop systemd-enable systemd-disable:
+	systemctl $(patsubst systemd-%,%,$@) simdb-dashboard
+
 # Deployment
 deploy:
 	@echo "TODO define deploy workflow here"

docker-compose.https.yml

@@ -0,0 +1,20 @@
+# HTTPS override for docker-compose.yml.
+#
+# Only adds or overrides TLS-specific settings.
+#
+# Enable this override by including it in COMPOSE_FILE,
+# after the original, e.g.
+#   COMPOSE_FILE="docker-compose.yml:docker-compose.https.yml"
+#   COMPOSE_FILE="docker-compose.yml:docker-compose.https.yml:docker-compose.systemd.yml"
+#
+services:
+  dashboard:
+    environment:
+      # Use server-https.conf when TLS certificates (server.pem and server.key) are provided.
+      SERVER_CONF: ${SERVER_CONF:-server-https.conf}
+    ports:
+      - "${DASHBOARD_PORT:-80}:80"
+      - "${DASHBOARD_HTTPS_PORT:-443}:443"
+    volumes:
+      - ./docker/nginx/templates:/etc/nginx/templates
+      - ./docker/nginx/tls:/etc/nginx/tls:ro

docker-compose.systemd.yml

@@ -0,0 +1,19 @@
+# Systemd override for docker-compose.yml.
+#
+# Uses the GHCR-published image instead of a local build.
+#
+# Set SIMDB_DASHBOARD_TAG in the environment file to pin a specific
+# version. The default is the latest tag at the time of writing.
+#
+# Enable this override by including it in COMPOSE_FILE,
+# after the original, e.g.
+#   COMPOSE_FILE="docker-compose.yml:docker-compose.https.yml"
+#   COMPOSE_FILE="docker-compose.yml:docker-compose.https.yml:docker-compose.systemd.yml"
+#
+services:
+  dashboard:
+    image: ${SIMDB_DASHBOARD_IMAGE:-ghcr.io/iterorganization/simdb-dashboard}:${SIMDB_DASHBOARD_TAG:-latest}
+    logging:
+      driver: journald
+      options:
+        tag: simdb-dashboard

docker-compose.yml

@@ -1,9 +1,10 @@
 services:
   dashboard:
+    container_name: ${DASHBOARD_CONTAINER_NAME:-simdb-dashboard}
     image: simdb-dashboard:service
     labels:
       io.simdb.component: "dashboard"
-    build: 
+    build:
       context: .
       args:
         APP_VERSION: ${APP_VERSION:-0.0.0-unknown}
@@ -18,7 +19,6 @@ services:
     ports:
       - "${DASHBOARD_PORT:-80}:80"
     volumes:
-      - ./docker/dashboard.nginx:/etc/nginx/templates/default.conf.template
-      - ./docker/runtime-config-template.js:/usr/share/nginx/html/runtime-config-template.js
+      - ./docker/nginx/templates:/etc/nginx/templates
     extra_hosts:
       - "host.docker.internal:host-gateway"