From 92c4e7187bcfe65b62bd982d4ee541605ab36eb2 Mon Sep 17 00:00:00 2001
From: Darkraise <quangtc94@gmail.com>
Date: Mon, 2 Feb 2026 17:25:37 +0700
Subject: [PATCH] ci: update frontend nginx config

---
 .../default.conf.template}                    |  0
 frontend/.nginx/nginx.conf                    | 48 +++++++++++++++++++
 frontend/Dockerfile                           | 20 ++------
 frontend/docker-entrypoint.sh                 |  7 +--
 4 files changed, 55 insertions(+), 20 deletions(-)
 rename frontend/{nginx.conf => .nginx/default.conf.template} (100%)
 create mode 100644 frontend/.nginx/nginx.conf

diff --git a/frontend/nginx.conf b/frontend/.nginx/default.conf.template
similarity index 100%
rename from frontend/nginx.conf
rename to frontend/.nginx/default.conf.template
diff --git a/frontend/.nginx/nginx.conf b/frontend/.nginx/nginx.conf
new file mode 100644
index 0000000..c180afc
--- /dev/null
+++ b/frontend/.nginx/nginx.conf
@@ -0,0 +1,48 @@
+# Main nginx configuration for Flashpoint Web Frontend
+# Optimized for Docker container running as non-root user
+
+# Don't use 'user' directive when running as non-root
+# worker_processes auto is fine for most cases
+worker_processes auto;
+
+# Log to stdout/stderr for Docker (no file permission issues)
+error_log /dev/stderr warn;
+
+# PID file location (must be writable by non-root user)
+pid /tmp/nginx.pid;
+
+events {
+    worker_connections 1024;
+    use epoll;
+    multi_accept on;
+}
+
+http {
+    # Include mime types
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    # Logging to stdout for Docker
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /dev/stdout main;
+
+    # Performance optimizations
+    sendfile on;
+    tcp_nopush on;
+    tcp_nodelay on;
+    keepalive_timeout 65;
+    types_hash_max_size 2048;
+
+    # Temp directories (must be writable by non-root user)
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path /tmp/proxy_temp;
+    fastcgi_temp_path /tmp/fastcgi_temp;
+    uwsgi_temp_path /tmp/uwsgi_temp;
+    scgi_temp_path /tmp/scgi_temp;
+
+    # Include server configurations
+    include /etc/nginx/conf.d/*.conf;
+}
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index a58519e..6086b71 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -50,8 +50,10 @@ RUN apk add --no-cache curl tzdata su-exec shadow gettext
 # Copy built files from builder
 COPY --from=builder /app/frontend/dist /usr/share/nginx/html
 
-# Copy nginx configuration
-COPY frontend/nginx.conf /etc/nginx/templates/default.conf.template
+# Copy nginx configuration from .nginx/ folder
+# Main config: logs to stdout/stderr, uses /tmp for temp files (no permission issues)
+COPY frontend/.nginx/nginx.conf /etc/nginx/nginx.conf
+COPY frontend/.nginx/default.conf.template /etc/nginx/templates/default.conf.template
 
 # Copy entrypoint script
 COPY frontend/docker-entrypoint.sh /docker-entrypoint.sh
@@ -60,26 +62,14 @@ COPY frontend/docker-entrypoint.sh /docker-entrypoint.sh
 ENV BACKEND_HOST=backend \
     BACKEND_PORT=3100
 
-# Create non-root user with default UID/GID 1000 (nginx:alpine doesn't have one)
+# Create non-root user with default UID/GID 1000
 # These can be overridden at runtime via PUID/PGID environment variables
 RUN addgroup -g 1000 -S appuser && \
     adduser -S appuser -u 1000 -G appuser && \
     chown -R appuser:appuser /usr/share/nginx/html && \
-    chown -R appuser:appuser /var/cache/nginx && \
-    chown -R appuser:appuser /var/log/nginx && \
     chown -R appuser:appuser /etc/nginx/conf.d && \
-    touch /var/run/nginx.pid && \
-    chown -R appuser:appuser /var/run/nginx.pid && \
     chmod +x /docker-entrypoint.sh
 
-# Create necessary directories
-RUN mkdir -p /var/cache/nginx/client_temp \
-    /var/cache/nginx/proxy_temp \
-    /var/cache/nginx/fastcgi_temp \
-    /var/cache/nginx/uwsgi_temp \
-    /var/cache/nginx/scgi_temp && \
-    chown -R appuser:appuser /var/cache/nginx
-
 # Expose port (8080 for non-root user)
 EXPOSE 8080
 
diff --git a/frontend/docker-entrypoint.sh b/frontend/docker-entrypoint.sh
index f43716f..7d0509a 100644
--- a/frontend/docker-entrypoint.sh
+++ b/frontend/docker-entrypoint.sh
@@ -60,13 +60,10 @@ setup_user() {
         echo "✅ User UID/GID OK (UID=$PUID, GID=$PGID)"
     fi
 
-    # Always fix ownership of nginx directories (in case of mounted volumes)
-    echo "🔧 Ensuring correct ownership of nginx directories..."
+    # Fix ownership of directories that may be mounted as volumes
+    echo "🔧 Ensuring correct ownership of app directories..."
     chown -R $APP_USER:$APP_GROUP /usr/share/nginx/html 2>/dev/null || true
-    chown -R $APP_USER:$APP_GROUP /var/cache/nginx 2>/dev/null || true
-    chown -R $APP_USER:$APP_GROUP /var/log/nginx 2>/dev/null || true
     chown -R $APP_USER:$APP_GROUP /etc/nginx/conf.d 2>/dev/null || true
-    chown $APP_USER:$APP_GROUP /var/run/nginx.pid 2>/dev/null || true
 }
 
 # Only setup user if running as root