docker release

2026-09-06 09:40:35 +12:00
commit a21a139bf6
7 changed files with 568 additions and 0 deletions
--- a/.env.example
+++ b/.env.example
@@ -0,0 +1,57 @@
+# Copy to .env and adjust.  Both ./build-and-push.sh and `docker compose`
+# load this .env automatically.
+#
+#   cp .env.example .env
+
+# NOTE: this is the committed template. Put real values in .env, never here —
+# only .env is gitignored.
+
+# ---- Docker Hub ----------------------------------------------------------
+# Your Docker Hub user or organisation. Images are pushed as
+# $DOCKERHUB_NAMESPACE/<image>:<tag>
+DOCKERHUB_NAMESPACE=abdtag
+
+# Docker Hub user used for `docker login`. Usually the same as the namespace,
+# but differs when pushing to an org.
+DOCKERHUB_USERNAME=abdtag
+
+# A Docker Hub *access token* (Account Settings -> Personal access tokens).
+# Leave empty to be prompted, or to rely on an existing `docker login`.
+DOCKERHUB_TOKEN=
+
+# ---- Build ---------------------------------------------------------------
+# Tag applied to every image. Empty => auto-generated (see README):
+#   <short-git-sha>-<UTC timestamp>, e.g. a1b2c3d-20260905T2015Z
+TAG=
+
+# Also tag and push :latest alongside $TAG.
+PUSH_LATEST=true
+
+# Target architectures. The Fennec servers are x86_64, so amd64 is the default.
+# Use "linux/amd64,linux/arm64" for images that must also run on Apple Silicon;
+# the Angular builds are noticeably slower under arm64 emulation.
+PLATFORMS=linux/amd64
+
+# Angular build memory (frontend images only). Leave empty to use the defaults
+# baked into each Dockerfile, which are sized for a ~8GB Docker VM.
+#
+# NODE_MAX_OLD_SPACE is the per-worker heap in MB; NG_BUILD_MAX_WORKERS is how
+# many compile workers run at once. Peak memory is roughly the product, and it
+# must fit in Docker Desktop -> Settings -> Resources -> Memory. If a build
+# fails with "JS heap out of memory", raise the Docker VM memory first, then
+# raise these. To build faster on a bigger machine, raise the worker count.
+#NODE_MAX_OLD_SPACE=8192
+#NG_BUILD_MAX_WORKERS=2
+
+# ---- Deploy (docker-compose.yml) -----------------------------------------
+# Only needed on the machine running `docker compose up`. TAG above selects
+# which pushed tag gets deployed; empty => :latest.
+
+# Required — compose refuses to start without it.
+SPRING_DATASOURCE_PASSWORD=
+
+# Optional overrides; the compose file has working defaults for each.
+#SPRING_PROFILES_ACTIVE=custom
+#SPRING_DATASOURCE_USERNAME=root
+#SPRING_DATASOURCE_URL=jdbc:mysql://host.docker.internal:3306/fennecpro?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC
+#FENNEC_HUB_SECURITY_CORS_ALLOWED_ORIGINS=http://localhost,http://localhost:4200,https://hub.fennecsm.com,https://ecom.fennecsm.com
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,2 @@
+# Holds the Docker Hub token — never commit it.
+.env
--- a/README.md
+++ b/README.md
@@ -0,0 +1,92 @@
+# docker-release
+
+Builds every Fennec Hub project into a Docker image and pushes it to Docker Hub.
+
+| Key        | Image                              | Source                                                        |
+|------------|------------------------------------|---------------------------------------------------------------|
+| `backend`  | `<namespace>/fennec-hub-backend`   | `fennec-hub-multi-tenant-shared-db` (+ `fennec-hub-platfrom`)  |
+| `admin`    | `<namespace>/fennec-hub-admin-ui`  | `fennec-hub-angular-ui`                                        |
+| `commerce` | `<namespace>/fennec-hub-commerce`  | `fennec-hub-commerce`                                          |
+
+`fennec-hub-platfrom` produces no image of its own — it is a Maven library that
+the backend Dockerfile installs from the repo-root build context before
+packaging the Spring Boot jar.
+
+## Setup (once)
+
+```bash
+cd docker-release
+cp .env.example .env
+$EDITOR .env        # set DOCKERHUB_NAMESPACE, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN
+```
+
+Create the token at Docker Hub → *Account Settings → Personal access tokens*
+with **Read & Write** scope. `.env` is gitignored; leaving `DOCKERHUB_TOKEN`
+empty makes `docker login` prompt instead.
+
+## Use
+
+```bash
+./build-and-push.sh list              # what would be built, and under which tag
+./build-and-push.sh all               # login, build all three, push to Docker Hub
+./build-and-push.sh build             # build locally, push nothing
+./build-and-push.sh all -s admin      # one image only (-s is repeatable)
+./build-and-push.sh all -t 2026.09.05 # pin the tag instead of auto-generating
+./build-and-push.sh all --dry-run     # print the docker commands, run nothing
+```
+
+Every run also tags `:latest` unless you pass `--no-latest`.
+
+### Tags
+
+With no `-t` / `TAG=`, the tag is `<backend-git-sha>-<UTC timestamp>`, e.g.
+`a1b2c3d-20260905T2015Z`, falling back to just the timestamp when the backend
+directory is not a git checkout. That keeps every push traceable and immutable
+while `:latest` moves.
+
+### Architectures
+
+`PLATFORMS` defaults to `linux/amd64` (the Fennec servers). For a multi-arch
+image, pass `-p linux/amd64,linux/arm64` — the script then creates a
+`docker-container` buildx builder automatically. Multi-platform results cannot
+be loaded into the local image store, so they must be pushed: use `push`/`all`,
+not `build`. The Angular builds are slow under arm64 emulation.
+
+## Deploying what you pushed
+
+`docker-compose.yml` in this folder is the deployment counterpart of the
+repo-root one: same services and ports, but pulling the published images
+instead of building from source. It needs no source tree, so this file plus a
+`.env` can be copied to a server on its own.
+
+```bash
+cd docker-release
+docker compose pull
+docker compose up -d
+```
+
+Compose loads the same `.env` the build script uses, so `DOCKERHUB_NAMESPACE`
+and `TAG` carry over — set `TAG` to the tag you pushed (empty means `:latest`),
+or override per-run:
+
+```bash
+TAG=a1b2c3d-20260905T2015Z docker compose up -d
+```
+
+`SPRING_DATASOURCE_PASSWORD` is required and has no default — compose refuses
+to start without it. Set it in `.env` (gitignored) or in the environment. The
+datasource URL, username, CORS origins and Spring profile all have working
+defaults and are overridable the same way.
+
+`docker-compose.hub.yml` is the identical file under its original name, kept
+for anyone already referencing it with `-f`. Edit both if you change one.
+
+## Adding a project
+
+Append a line to `images.conf`:
+
+```
+key | image-name | build-context | path/to/Dockerfile | description
+```
+
+Paths are relative to the repo root. Nothing in the script needs to change.
--- a/build-and-push.sh
+++ b/build-and-push.sh
@@ -0,0 +1,280 @@
+#!/usr/bin/env bash
+#
+# Build every Fennec Hub image and push it to Docker Hub.
+#
+#   ./build-and-push.sh all                 # build + push all three images
+#   ./build-and-push.sh build               # build locally, don't push
+#   ./build-and-push.sh all -s admin        # just the admin UI
+#   ./build-and-push.sh all -t 2026.09.05   # explicit tag
+#
+# Configuration lives in .env (see .env.example); the image catalogue lives in
+# images.conf.  Run --help for the full option list.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+CATALOGUE="$SCRIPT_DIR/images.conf"
+
+# ---------------------------------------------------------------- output ----
+if [[ -t 1 ]]; then
+    C_RESET=$'\033[0m'; C_BOLD=$'\033[1m'; C_DIM=$'\033[2m'
+    C_RED=$'\033[31m'; C_GREEN=$'\033[32m'; C_YELLOW=$'\033[33m'; C_BLUE=$'\033[34m'
+else
+    C_RESET=; C_BOLD=; C_DIM=; C_RED=; C_GREEN=; C_YELLOW=; C_BLUE=
+fi
+
+log()   { printf '%s\n' "${C_BLUE}==>${C_RESET} $*"; }
+info()  { printf '%s\n' "    ${C_DIM}$*${C_RESET}"; }
+ok()    { printf '%s\n' "${C_GREEN}  ✓${C_RESET} $*"; }
+warn()  { printf '%s\n' "${C_YELLOW}  !${C_RESET} $*" >&2; }
+die()   { printf '%s\n' "${C_RED}error:${C_RESET} $*" >&2; exit 1; }
+
+# ------------------------------------------------------------ config ----
+[[ -f "$SCRIPT_DIR/.env" ]] && { set -a; . "$SCRIPT_DIR/.env"; set +a; }
+
+DOCKERHUB_NAMESPACE="${DOCKERHUB_NAMESPACE:-fennecsm}"
+DOCKERHUB_USERNAME="${DOCKERHUB_USERNAME:-$DOCKERHUB_NAMESPACE}"
+DOCKERHUB_TOKEN="${DOCKERHUB_TOKEN:-}"
+PLATFORMS="${PLATFORMS:-linux/amd64}"
+PUSH_LATEST="${PUSH_LATEST:-true}"
+TAG="${TAG:-}"
+
+# Angular build memory. Empty => use the per-Dockerfile defaults. Set these to
+# override both frontends at once without editing the Dockerfiles.
+NODE_MAX_OLD_SPACE="${NODE_MAX_OLD_SPACE:-}"
+NG_BUILD_MAX_WORKERS="${NG_BUILD_MAX_WORKERS:-}"
+
+SERVICES=""
+NO_CACHE=""
+DRY_RUN=false
+BUILDER_NAME="fennec-release"
+
+usage() {
+    cat <<EOF
+${C_BOLD}Usage:${C_RESET} $(basename "$0") <command> [options]
+
+${C_BOLD}Commands${C_RESET}
+  build            Build images locally (no push). Single platform only.
+  push             Build and push images to Docker Hub.
+  all              Alias for push (login + build + push).
+  login            Log in to Docker Hub and exit.
+  list             Show the image catalogue and the tags that would be used.
+
+${C_BOLD}Options${C_RESET}
+  -s, --service <k>   Only this image; repeatable. Keys: $(cut -d'|' -f1 "$CATALOGUE" 2>/dev/null | grep -v '^#' | tr -d ' ' | grep . | paste -sd, -)
+  -t, --tag <tag>     Tag to apply (default: auto <git-sha>-<timestamp>)
+  -n, --namespace <n> Docker Hub namespace (default: $DOCKERHUB_NAMESPACE)
+  -p, --platforms <p> Target platforms (default: $PLATFORMS)
+      --no-latest     Do not also tag/push :latest
+      --no-cache      Build without the Docker layer cache
+      --dry-run       Print the docker commands instead of running them
+  -h, --help          This message
+
+${C_BOLD}Examples${C_RESET}
+  $(basename "$0") list
+  $(basename "$0") build -s admin
+  $(basename "$0") all -t 2026.09.05 -p linux/amd64,linux/arm64
+EOF
+}
+
+# -------------------------------------------------------------- args ----
+[[ $# -eq 0 ]] && { usage; exit 1; }
+COMMAND="$1"; shift
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        -s|--service)   SERVICES="$SERVICES $2"; shift 2 ;;
+        -t|--tag)       TAG="$2"; shift 2 ;;
+        -n|--namespace) DOCKERHUB_NAMESPACE="$2"; shift 2 ;;
+        -p|--platforms) PLATFORMS="$2"; shift 2 ;;
+        --no-latest)    PUSH_LATEST=false; shift ;;
+        --no-cache)     NO_CACHE="--no-cache"; shift ;;
+        --dry-run)      DRY_RUN=true; shift ;;
+        -h|--help)      usage; exit 0 ;;
+        *)              die "unknown option: $1 (try --help)" ;;
+    esac
+done
+
+# ------------------------------------------------------------- helpers ----
+run() {
+    if $DRY_RUN; then
+        printf '%s\n' "    ${C_DIM}[dry-run]${C_RESET} $*"
+    else
+        "$@"
+    fi
+}
+
+# Auto tag: <short sha of the project's own repo>-<UTC timestamp>.
+# Each project is its own git repo; the repo root is not, so fall back
+# gracefully when no sha is available.
+make_tag() {
+    local sha
+    sha="$(git -C "$REPO_ROOT/fennec-hub-multi-tenant-shared-db" rev-parse --short=7 HEAD 2>/dev/null || true)"
+    local stamp
+    stamp="$(date -u +%Y%m%dT%H%MZ)"
+    if [[ -n "$sha" ]]; then
+        printf '%s-%s' "$sha" "$stamp"
+    else
+        printf '%s' "$stamp"
+    fi
+}
+
+# Emits "key|image|context|dockerfile|description" for each selected image.
+selected_images() {
+    [[ -f "$CATALOGUE" ]] || die "catalogue not found: $CATALOGUE"
+    local line key image context dockerfile description
+    while IFS='|' read -r key image context dockerfile description; do
+        key="$(printf '%s' "$key" | tr -d '[:space:]')"
+        [[ -z "$key" || "$key" == \#* ]] && continue
+        if [[ -n "${SERVICES// /}" ]]; then
+            [[ " $SERVICES " == *" $key "* ]] || continue
+        fi
+        image="$(printf '%s' "$image" | tr -d '[:space:]')"
+        context="$(printf '%s' "$context" | tr -d '[:space:]')"
+        dockerfile="$(printf '%s' "$dockerfile" | tr -d '[:space:]')"
+        description="$(printf '%s' "$description" | sed 's/^ *//; s/ *$//')"
+        printf '%s|%s|%s|%s|%s\n' "$key" "$image" "$context" "$dockerfile" "$description"
+    done < "$CATALOGUE"
+}
+
+validate_selection() {
+    local found=false k
+    while IFS='|' read -r k _; do found=true; done < <(selected_images)
+    $found || die "no images matched --service '${SERVICES# }'. Run '$(basename "$0") list'."
+}
+
+docker_login() {
+    if [[ -n "$DOCKERHUB_TOKEN" ]]; then
+        log "Logging in to Docker Hub as $DOCKERHUB_USERNAME"
+        if $DRY_RUN; then
+            info "[dry-run] docker login -u $DOCKERHUB_USERNAME --password-stdin"
+        else
+            printf '%s' "$DOCKERHUB_TOKEN" \
+                | docker login -u "$DOCKERHUB_USERNAME" --password-stdin >/dev/null \
+                || die "docker login failed"
+            ok "authenticated"
+        fi
+    elif docker system info 2>/dev/null | grep -q "Username:"; then
+        ok "already logged in to Docker Hub"
+    else
+        log "Logging in to Docker Hub as $DOCKERHUB_USERNAME"
+        warn "DOCKERHUB_TOKEN is not set — docker will prompt for a password/token"
+        $DRY_RUN || docker login -u "$DOCKERHUB_USERNAME" || die "docker login failed"
+    fi
+}
+
+ensure_builder() {
+    # A multi-platform build needs a buildx builder backed by the
+    # docker-container driver; the default "docker" driver cannot do it.
+    if [[ "$PLATFORMS" != *,* ]]; then
+        return 0
+    fi
+    if docker buildx inspect "$BUILDER_NAME" >/dev/null 2>&1; then
+        info "using buildx builder '$BUILDER_NAME'"
+    else
+        log "Creating buildx builder '$BUILDER_NAME' (multi-platform)"
+        run docker buildx create --name "$BUILDER_NAME" --driver docker-container --bootstrap
+    fi
+    run docker buildx use "$BUILDER_NAME"
+}
+
+build_image() {
+    local key="$1" image="$2" context="$3" dockerfile="$4" push="$5"
+    local repo="$DOCKERHUB_NAMESPACE/$image"
+    local -a args=()
+
+    [[ -f "$REPO_ROOT/$dockerfile" ]] || die "$key: dockerfile not found: $dockerfile"
+    [[ -d "$REPO_ROOT/$context"    ]] || die "$key: build context not found: $context"
+
+    args+=(buildx build)
+    args+=(--file "$REPO_ROOT/$dockerfile")
+    args+=(--platform "$PLATFORMS")
+    args+=(--tag "$repo:$TAG")
+    [[ "$PUSH_LATEST" == "true" ]] && args+=(--tag "$repo:latest")
+    args+=(--label "org.opencontainers.image.title=$image")
+    args+=(--label "org.opencontainers.image.version=$TAG")
+    args+=(--label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)")
+    [[ -n "$NO_CACHE" ]] && args+=("$NO_CACHE")
+
+    # Angular memory knobs — only the frontend images declare these ARGs, and
+    # passing an unused --build-arg is a warning, so scope them to the frontends.
+    if [[ "$key" != "backend" ]]; then
+        [[ -n "$NODE_MAX_OLD_SPACE" ]]    && args+=(--build-arg "NODE_MAX_OLD_SPACE=$NODE_MAX_OLD_SPACE")
+        [[ -n "$NG_BUILD_MAX_WORKERS" ]]  && args+=(--build-arg "NG_BUILD_MAX_WORKERS=$NG_BUILD_MAX_WORKERS")
+    fi
+
+    if [[ "$push" == "true" ]]; then
+        args+=(--push)
+    else
+        args+=(--load)
+    fi
+
+    args+=("$REPO_ROOT/$context")
+
+    log "${C_BOLD}$key${C_RESET} -> $repo:$TAG"
+    info "context=$context dockerfile=$dockerfile platforms=$PLATFORMS"
+    run docker "${args[@]}"
+    ok "$key done"
+}
+
+do_build() {
+    local push="$1"
+    validate_selection
+
+    # Multi-platform results cannot land in the local image store, so catch the
+    # conflict before spending time on a builder or a build.
+    if [[ "$push" != "true" && "$PLATFORMS" == *,* ]]; then
+        die "multi-platform builds must be pushed; use 'push'/'all', or -p linux/amd64"
+    fi
+
+    [[ -n "$TAG" ]] || TAG="$(make_tag)"
+    ensure_builder
+
+    log "Namespace ${C_BOLD}$DOCKERHUB_NAMESPACE${C_RESET}   tag ${C_BOLD}$TAG${C_RESET}$( [[ "$PUSH_LATEST" == "true" ]] && printf ' (+ latest)' )"
+
+    local key image context dockerfile _desc
+    local -a pushed=()
+    while IFS='|' read -r key image context dockerfile _desc; do
+        build_image "$key" "$image" "$context" "$dockerfile" "$push"
+        pushed+=("$DOCKERHUB_NAMESPACE/$image:$TAG")
+    done < <(selected_images)
+
+    echo
+    if [[ "$push" == "true" ]]; then
+        log "Pushed to Docker Hub:"
+    else
+        log "Built locally:"
+    fi
+    printf '      %s\n' "${pushed[@]}"
+
+    if [[ "$push" == "true" ]]; then
+        echo
+        info "Deploy with:  cd docker-release && TAG=$TAG docker compose up -d"
+    fi
+}
+
+do_list() {
+    [[ -n "$TAG" ]] || TAG="$(make_tag)"
+    log "Namespace ${C_BOLD}$DOCKERHUB_NAMESPACE${C_RESET}   tag ${C_BOLD}$TAG${C_RESET}   platforms ${C_BOLD}$PLATFORMS${C_RESET}"
+    echo
+    printf '  %-10s %-40s %s\n' "KEY" "IMAGE" "DESCRIPTION"
+    local key image context dockerfile desc
+    while IFS='|' read -r key image context dockerfile desc; do
+        printf '  %-10s %-40s %s\n' "$key" "$DOCKERHUB_NAMESPACE/$image" "$desc"
+    done < <(selected_images)
+}
+
+# ------------------------------------------------------------ dispatch ----
+command -v docker >/dev/null 2>&1 || die "docker is not installed or not on PATH"
+
+case "$COMMAND" in
+    list)   do_list ;;
+    login)  docker_login ;;
+    build)  do_build false ;;
+    push|all)
+            docker_login
+            do_build true ;;
+    -h|--help|help) usage ;;
+    *)      die "unknown command: $COMMAND (try --help)" ;;
+esac
--- a/docker-compose.hub.yml
+++ b/docker-compose.hub.yml
@@ -0,0 +1,60 @@
+# Deployment compose file — pulls the published images from Docker Hub instead
+# of building from source. Nothing here needs the source tree, so this file can
+# be copied to a server on its own.
+#
+# NOTE: docker-compose.yml in this folder is the same thing under the default
+# name, and is what the README and build-and-push.sh point at. Keep the two in
+# sync if you edit one.
+#
+#   DOCKERHUB_NAMESPACE=fennecsm TAG=latest docker compose -f docker-compose.hub.yml up -d
+#
+# Secrets (DB password) come from the environment or a .env sitting next to
+# this file — they are deliberately not hard-coded here.
+
+services:
+  backend:
+    image: ${DOCKERHUB_NAMESPACE:-fennecsm}/fennec-hub-backend:${TAG:-latest}
+    container_name: fennec-backend
+    restart: unless-stopped
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-custom}
+      SPRING_DATASOURCE_URL: ${SPRING_DATASOURCE_URL:-jdbc:mysql://host.docker.internal:3306/fennecpro?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC}
+      SPRING_DATASOURCE_USERNAME: ${SPRING_DATASOURCE_USERNAME:-root}
+      SPRING_DATASOURCE_PASSWORD: ${SPRING_DATASOURCE_PASSWORD:?set SPRING_DATASOURCE_PASSWORD in the environment or .env}
+      # Honor X-Forwarded-* from nginx so Spring reconstructs the original URL.
+      SERVER_FORWARD_HEADERS_STRATEGY: framework
+      FENNEC_HUB_SECURITY_CORS_ALLOWED_ORIGINS: ${FENNEC_HUB_SECURITY_CORS_ALLOWED_ORIGINS:-http://localhost,http://localhost:4200,https://hub.fennecsm.com,https://ecom.fennecsm.com}
+    ports:
+      - "9999:8080"
+    volumes:
+      - /home/fennec/hub:/home/fennec/hub
+    networks:
+      - fennec
+
+  frontend:
+    image: ${DOCKERHUB_NAMESPACE:-fennecsm}/fennec-hub-admin-ui:${TAG:-latest}
+    container_name: fennec-frontend
+    restart: unless-stopped
+    ports:
+      - "8888:80"
+    depends_on:
+      - backend
+    networks:
+      - fennec
+
+  frontendcomm:
+    image: ${DOCKERHUB_NAMESPACE:-fennecsm}/fennec-hub-commerce:${TAG:-latest}
+    container_name: fennec-frontendcomm
+    restart: unless-stopped
+    ports:
+      - "8889:80"
+    depends_on:
+      - backend
+    networks:
+      - fennec
+
+networks:
+  fennec:
+    driver: bridge
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -0,0 +1,62 @@
+# Deployment compose file — pulls the images published by build-and-push.sh
+# from Docker Hub instead of building from source.
+#
+# Nothing here needs the source tree, so this file (plus a .env) can be copied
+# to a server on its own:
+#
+#   docker compose pull && docker compose up -d
+#
+# Values come from the .env sitting next to this file, which compose loads
+# automatically — the same .env build-and-push.sh uses. Copy .env.example to
+# .env and fill it in. Secrets are deliberately not hard-coded here.
+
+services:
+  backend:
+    image: ${DOCKERHUB_NAMESPACE:-fennecsm}/fennec-hub-backend:${TAG:-latest}
+    container_name: fennec-backend
+    restart: unless-stopped
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      SPRING_PROFILES_ACTIVE: ${SPRING_PROFILES_ACTIVE:-custom}
+      SPRING_DATASOURCE_URL: ${SPRING_DATASOURCE_URL:-jdbc:mysql://host.docker.internal:3306/fennecpro?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC}
+      SPRING_DATASOURCE_USERNAME: ${SPRING_DATASOURCE_USERNAME:-root}
+      SPRING_DATASOURCE_PASSWORD: ${SPRING_DATASOURCE_PASSWORD:?set SPRING_DATASOURCE_PASSWORD in .env}
+      # Honor X-Forwarded-* from nginx so Spring reconstructs the original URL
+      # (http://localhost) instead of seeing http://backend:8080.
+      SERVER_FORWARD_HEADERS_STRATEGY: framework
+      # CORS allow-list — frontend served via nginx on http://localhost (port 80).
+      # Keep :4200 so the non-dockerized Angular dev server still works.
+      FENNEC_HUB_SECURITY_CORS_ALLOWED_ORIGINS: ${FENNEC_HUB_SECURITY_CORS_ALLOWED_ORIGINS:-http://localhost,http://localhost:4200,https://hub.fennecsm.com,https://ecom.fennecsm.com}
+    ports:
+      - "9999:8080"
+    volumes:
+      - /home/fennec/hub:/home/fennec/hub
+    networks:
+      - fennec
+
+  frontend:
+    image: ${DOCKERHUB_NAMESPACE:-fennecsm}/fennec-hub-admin-ui:${TAG:-latest}
+    container_name: fennec-frontend
+    restart: unless-stopped
+    ports:
+      - "8888:80"
+    depends_on:
+      - backend
+    networks:
+      - fennec
+
+  frontendcomm:
+    image: ${DOCKERHUB_NAMESPACE:-fennecsm}/fennec-hub-commerce:${TAG:-latest}
+    container_name: fennec-frontendcomm
+    restart: unless-stopped
+    ports:
+      - "8889:80"
+    depends_on:
+      - backend
+    networks:
+      - fennec
+
+networks:
+  fennec:
+    driver: bridge
--- a/images.conf
+++ b/images.conf
@@ -0,0 +1,15 @@
+# Image catalogue for build-and-push.sh
+#
+# Format (pipe-separated, one image per line):
+#
+#   key | image name | build context | dockerfile | description
+#
+# Paths are relative to the repo root (the parent of docker-release/).
+# Blank lines and lines starting with # are ignored.
+#
+# Note: fennec-hub-platfrom has no image of its own — it is a Maven library
+# that the backend Dockerfile builds and installs from the repo-root context.
+
+backend  | fennec-hub-backend    | .                       | fennec-hub-multi-tenant-shared-db/Dockerfile | Spring Boot API (bundles the fennec-hub-platfrom library)
+admin    | fennec-hub-admin-ui   | fennec-hub-angular-ui   | fennec-hub-angular-ui/Dockerfile             | Angular admin panel served by nginx
+commerce | fennec-hub-commerce   | fennec-hub-commerce     | fennec-hub-commerce/Dockerfile               | Angular storefront served by nginx