* feat(web): support deployment under a sub-path (VITE_BASE_PATH)
Enable deploying Veritas Kanban behind a reverse proxy under a sub-path
(e.g., /kanban/) without code modifications.
Changes:
- Dockerfile: add VITE_BASE_PATH build arg (default: /)
- vite.config.ts: set `base` from VITE_BASE_PATH
- config.ts: derive API_BASE from Vite's BASE_URL
- helpers.ts: prefix absolute URLs in apiFetch with BASE_URL
- useWebSocket.ts: include base path in default WS URL
- SecurityTab.tsx: prefix auth reset URL with BASE_URL
Usage:
docker build --build-arg VITE_BASE_PATH=/kanban/ -t veritas-kanban .
The reverse proxy should strip the prefix before forwarding to the
server (e.g., Traefik StripPrefix, nginx proxy_pass with trailing /).
Note: Some components use raw fetch('/api/...') instead of apiFetch().
These should be migrated incrementally — apiFetch now handles the
prefix automatically.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): migrate remaining raw fetch calls to use API_BASE
Replace hardcoded fetch('/api/...') with fetch(`${API_BASE}/...`)
in 9 component files that were bypassing the base path config:
- ExportDialog (telemetry export)
- DelegationTab (delegation CRUD)
- ToolPoliciesTab (policy save/delete)
- DependenciesSection (dependency management)
- WorkflowSection (workflow status)
- TaskDetailsTab (task creation)
- WorkflowRunList (run listing)
- WorkflowRunView (run details + resume)
- WorkflowsPage (workflow listing + run start)
This ensures all API calls respect VITE_BASE_PATH for sub-path
deployments (e.g., /kanban/).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Services resolve .veritas-kanban using process.cwd()/.. which pointed to
/ (root filesystem) when WORKDIR was /app. Changed production WORKDIR to
/app/server so cwd/.. correctly resolves to /app.
Also ensures /app/tasks and /app/server are writable by the veritas user
for services that use process.cwd() directly (e.g. ActivityService).
Fixes container crash: EACCES permission denied, mkdir '/.veritas-kanban'
Fixes#35
- Copy real web/package.json instead of creating a minimal stub, which
caused pnpm-lock.yaml specifier mismatch with --frozen-lockfile
- Add --ignore-scripts to skip husky prepare hook in container builds
- Remove web/node_modules after install (frontend is pre-built static)
- Create .veritas-kanban directory with correct ownership for non-root user
Closes#35
