From f8b68f2e126f88ef6df40029ee642999938131fe Mon Sep 17 00:00:00 2001
From: aarroyo <beyondnet.peru@gmail.com>
Date: Fri, 24 Jul 2026 21:11:57 -0500
Subject: [PATCH] fix(tracker-web): bake versioned BFF base /api/v1 + add build
 .dockerignore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tracker-web image baked VITE_TRACKER_BFF_BASE_URL=/api (a stale ARG
default predating the CD-32 versioned surface). The SPA's own code default is
/api/v1 and tracker-api serves its business surface under /api/v1, so the built
SPA called /api/auth/config → 404 and the login screen failed with "Could not
reach the auth service". Baking /api/v1 aligns the SPA with the versioned BFF;
nginx's /api/ proxy already covers it.

Also add src/.dockerignore: the tracker image build contexts are src/, which
carried 663 MB of node_modules (1.1 GB total) with no ignore file — every image
restores deps from scratch, so host build outputs must never leak in.

Surfaced while wiring the Objective-1 (GT-447) one-command full-stack local
bring-up (evolith/product/infra/docker-compose.fullstack.yml).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/.dockerignore               | 33 +++++++++++++++++++++++++++++++++
 src/apps/tracker-web/Dockerfile | 11 ++++++-----
 2 files changed, 39 insertions(+), 5 deletions(-)
 create mode 100644 src/.dockerignore

diff --git a/src/.dockerignore b/src/.dockerignore
new file mode 100644
index 00000000..ba8390f9
--- /dev/null
+++ b/src/.dockerignore
@@ -0,0 +1,33 @@
+# Build contexts for the Tracker images (tracker-web, tracker-api, tracker-gateway)
+# are this `src/` directory. Keep the context small and hermetic: every image
+# restores its own dependencies and builds from source inside the build, so host
+# build outputs and installed modules must never leak in.
+
+# Node / Nx
+**/node_modules
+dist
+.nx
+tmp
+.angular
+coverage
+playwright-report
+test-output
+**/*.tsbuildinfo
+
+# .NET build outputs (the tracker-api image restores + publishes from source)
+**/bin
+**/obj
+**/*.user
+
+# VCS / editor / OS
+.git
+.gitignore
+.vs
+.vscode
+.idea
+**/.DS_Store
+
+# Local env files must not be baked into images
+**/.env
+**/.env.*
+!**/.env.example
diff --git a/src/apps/tracker-web/Dockerfile b/src/apps/tracker-web/Dockerfile
index 0a4d99b7..47136933 100644
--- a/src/apps/tracker-web/Dockerfile
+++ b/src/apps/tracker-web/Dockerfile
@@ -6,10 +6,11 @@
 #   docker build -f apps/tracker-web/Dockerfile -t evolith-tracker-web:local src/
 #
 # The SPA reads its BFF base URL from VITE_TRACKER_BFF_BASE_URL at BUILD time
-# (import.meta.env). We default it to the relative path `/api`, and nginx (see
-# nginx.conf) proxies `/api` → the tracker-api service, so the same image works
-# in any cluster without rebuilding. Override VITE_TRACKER_BFF_BASE_URL as a
-# build-arg to bake an absolute URL instead.
+# (import.meta.env). We default it to the relative path `/api/v1` — the tracker-api
+# business surface is versioned under /api/v1 (CD-32), which is also the SPA's own
+# code default — and nginx (see nginx.conf) proxies `/api` → the tracker-api service,
+# so the same image works in any cluster without rebuilding. Override
+# VITE_TRACKER_BFF_BASE_URL as a build-arg to bake an absolute URL instead.
 # ──────────────────────────────────────────────────────────────────────────
 FROM node:20-alpine AS build
 
@@ -22,7 +23,7 @@ RUN npm ci --legacy-peer-deps
 # Bring in the workspace and build only the web app via the Nx/Vite target.
 COPY . ./
 
-ARG VITE_TRACKER_BFF_BASE_URL=/api
+ARG VITE_TRACKER_BFF_BASE_URL=/api/v1
 ENV VITE_TRACKER_BFF_BASE_URL=${VITE_TRACKER_BFF_BASE_URL}
 
 RUN npx nx build tracker-web --configuration=production \