feat: publish official Docker image on release

[koala73]

Summary

Add a GitHub Actions workflow to build and publish an official Docker image to ghcr.io/koala73/worldmonitor as part of the release process.

Motivation

Community members are already building and publishing unofficial images (see #1237). An official image ensures correctness, security, and consistency.

Requirements

• Build multi-arch image (linux/amd64, linux/arm64) on each GitHub release tag
• Push to ghcr.io/koala73/worldmonitor with :latest and :vX.Y.Z tags
• Include a Dockerfile in the repo root
• Document Docker usage in README

References

• Community image: ghcr.io/laochendeai/worldmonitor:latest (Docker Image of WorldMonitor published #1237)

[sanwalsulehri]

can i start work on this one!!

[koala73]

@sanwalsulehri sure

[koala73]

Detailed Acceptance Criteria

Scope: Frontend-only Docker image (Phase 1)

The Docker image should serve the static frontend only (Vite build output). The API layer (/api/) stays on Vercel — self-hosters point their instance at the cloud API or bring their own backend. This avoids the maintenance trap of reimplementing 55+ Edge Function routes.

Dockerfile Requirements

# Multi-stage build
# Stage 1: node:20-alpine — npm ci && npm run build (tsc + vite)
# Stage 2: nginx:alpine — copy dist/ + nginx.conf
# Result: ~30MB image, no node_modules in final image

• Must use node:20-alpine build stage
• Must use nginx:alpine runtime stage (not node for serving static files)
• VITE_* env vars should be injectable at build time via --build-arg
• .dockerignore must exclude: node_modules, .git, src-tauri, e2e, scripts, docs, .planning

nginx.conf

• SPA fallback: try_files $uri $uri/ /index.html
• Gzip enabled for JS/CSS/JSON/SVG
• /api/ proxy_pass to $API_UPSTREAM env var (default: https://api.worldmonitor.app)
• Security headers matching vercel.json (CSP, HSTS, etc.)

GitHub Actions Workflow (.github/workflows/docker-publish.yml)

on:
  release:
    types: [published]
  workflow_dispatch:  # manual trigger for testing

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-qemu-action@v3      # multi-arch
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v5         # auto-tag
        id: meta
        with:
          images: ghcr.io/koala73/worldmonitor
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest
      - uses: docker/build-push-action@v6
        with:
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Usage docs (README section)

docker run -d -p 3000:80 ghcr.io/koala73/worldmonitor:latest
# Custom API backend:
docker run -d -p 3000:80 -e API_UPSTREAM=http://my-api:3001 ghcr.io/koala73/worldmonitor:latest

What NOT to include

• ❌ No docker-compose.yml (Phase 1 is image-only)
• ❌ No Express/Node API server reimplementation
• ❌ No Redis in the image
• ❌ No .env.example changes

Test checklist

• docker build . succeeds
• docker run -p 3000:80 <image> serves the SPA
• SPA routes (e.g., /map, /dashboard) return index.html (not 404)
• /api/ requests proxy to cloud API
• Image size < 50MB
• Both amd64 and arm64 builds work

[sanwalsulehri]

#1309 -- done

[RepairYourTech]

does this make the backend self hostable too?

[koala73]

The backend was always self hostable. This makes it easier

[RepairYourTech]

The backend was always self hostable. This makes it easier

the readme says its just the webapp frontend for docker though and the rest uses your api in the cloud am i reading it wrong

[RepairYourTech]

The backend was always self hostable. This makes it easier

can you please clarify this please? i dont want to use vercel for the api if i can self host it in docker