From 9710ea581c177a46cff4eb8dffeb12ee1df69a65 Mon Sep 17 00:00:00 2001
From: mannes <info@mbtech.nl>
Date: Thu, 24 Sep 2026 08:15:56 +0200
Subject: [PATCH] Self-hosting: Docker image on GHCR, configurable base path

- BASE_PATH env var sets the Vite base, manifest id/start_url/scope and the
  SW navigateFallback (defaults to /collet/, so the Pages build is unchanged).
- Dockerfile: Node build stage + unprivileged nginx on :8080, served at /
  by default (--build-arg BASE_PATH=/collet/ for a subpath). SPA fallback for
  the /guide routes, no-cache on index/sw/manifest, immutable assets, /healthz.
- docker.yml: publishes ghcr.io/libreble/collet (amd64 + arm64) with
  GITHUB_TOKEN on main and v* tags; PRs build and run docker/smoke.sh.
- meta.ts: per-route canonical always points at libreble.github.io/collet/,
  also on self-hosted copies (it used window.location.origin).
- README: Self-host section. index.html: <noscript> description.
---
 .dockerignore                |  7 ++++
 .github/workflows/docker.yml | 66 ++++++++++++++++++++++++++++++++++++
 Dockerfile                   | 20 +++++++++++
 README.md                    | 45 ++++++++++++++++++++++++
 docker/nginx.conf.template   | 36 ++++++++++++++++++++
 docker/smoke.sh              | 23 +++++++++++++
 index.html                   |  9 +++++
 src/meta.ts                  | 14 +++++++-
 vite.config.ts               | 16 ++++++---
 9 files changed, 230 insertions(+), 6 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 .github/workflows/docker.yml
 create mode 100644 Dockerfile
 create mode 100644 docker/nginx.conf.template
 create mode 100755 docker/smoke.sh

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..b1cbfa7
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+node_modules
+dist
+dev-dist
+.git
+.github
+*.tsbuildinfo
+*.local
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..035e978
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,66 @@
+name: Container image
+
+# Publishes ghcr.io/libreble/<repo> (linux/amd64 + linux/arm64) with the built-in
+# GITHUB_TOKEN — no registry account or secrets. Pull requests build and smoke-test only.
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      # Build for the runner, run it, and check the page, assets, SW, manifest and SPA fallback.
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: smoke:test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - run: docker run -d --name smoke -p 8080:8080 smoke:test
+      - run: ./docker/smoke.sh http://localhost:8080/
+      - if: failure()
+        run: docker logs smoke
+
+      - if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - if: github.event_name != 'pull_request'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+          cache-from: type=gha
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..72ecdce
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+# syntax=docker/dockerfile:1
+# COLLET as a static site: build with Node, serve with unprivileged nginx on :8080.
+#   docker build -t collet .                               # served at /
+#   docker build --build-arg BASE_PATH=/collet/ -t collet .       # served at /collet/
+
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY . .
+ARG BASE_PATH=/
+RUN BASE_PATH="$BASE_PATH" npm run build
+
+FROM nginxinc/nginx-unprivileged:1.29-alpine
+ARG BASE_PATH=/
+ENV BASE_PATH=$BASE_PATH
+COPY docker/nginx.conf.template /etc/nginx/templates/default.conf.template
+COPY --from=build /app/dist /usr/share/nginx/html${BASE_PATH}
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO /dev/null http://127.0.0.1:8080/healthz || exit 1
diff --git a/README.md b/README.md
index e859a5f..6b35ab2 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,51 @@ npm run selftest   # runtime tests: STP framing, reassembly, protobuf, mock hand
 
 Web Bluetooth needs a secure context — `localhost` counts, otherwise serve over HTTPS.
 
+## Self-host
+
+The hosted app above is the easiest way. If you'd rather run your own copy, it's a static site —
+nothing to configure, no backend, no database.
+
+**Docker** — a prebuilt image (linux/amd64 + arm64) is published to the GitHub Container Registry:
+
+```bash
+docker run -d --name collet -p 8080:8080 --restart unless-stopped ghcr.io/libreble/collet
+# → http://localhost:8080/
+```
+
+```yaml
+# compose.yaml
+services:
+  collet:
+    image: ghcr.io/libreble/collet:latest
+    ports: ['8080:8080']
+    restart: unless-stopped
+```
+
+The image serves the app at `/`. To serve it under a subpath behind your own proxy, build it
+yourself: `docker build --build-arg BASE_PATH=/collet/ -t collet .`
+
+**Build and host it yourself** — any static web server works:
+
+```bash
+npm ci
+BASE_PATH=/ npm run build      # → dist/
+# upload dist/ to nginx, Caddy, Netlify, Cloudflare Pages, a bucket, …
+```
+
+Set `BASE_PATH` to the path you serve from (it defaults to `/collet/`, the GitHub Pages path).
+Two things your server should do: send unknown paths to `index.html` (client-side routes), and
+serve `index.html` and `sw.js` with `Cache-Control: no-cache` so updates reach installed copies.
+[`docker/nginx.conf.template`](docker/nginx.conf.template) is a working nginx example.
+
+> **HTTPS is required.** Web Bluetooth only works in a secure context. `http://localhost` counts,
+> so the app works on the machine running it — but `http://192.168.x.x:8080` from your phone
+> will load and then refuse to connect. For phones, put it behind TLS: a reverse proxy with a
+> real certificate (Caddy does this automatically for a domain), or `tailscale serve`.
+
+Self-hosted copies keep their `<link rel="canonical">` pointing at libreble.github.io, so
+search engines don't treat them as duplicates.
+
 ## Layout
 
 ```
diff --git a/docker/nginx.conf.template b/docker/nginx.conf.template
new file mode 100644
index 0000000..2cc7686
--- /dev/null
+++ b/docker/nginx.conf.template
@@ -0,0 +1,36 @@
+# Static server for the built PWA. BASE_PATH is substituted at container start
+# (nginx image envsubst; only defined env vars are replaced, so $uri stays as is).
+server {
+    listen 8080;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+    server_tokens off;
+
+    location = /healthz {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    # Hashed build output: cache forever.
+    location ${BASE_PATH}assets/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        add_header X-Content-Type-Options nosniff;
+        try_files $uri =404;
+    }
+
+    location ~ \.webmanifest$ {
+        default_type application/manifest+json;
+        add_header Cache-Control "no-cache";
+        add_header X-Content-Type-Options nosniff;
+    }
+
+    # index.html, sw.js and everything else: always revalidate so updates land.
+    # Unknown paths get the app shell (client-side routes, deep links).
+    location ${BASE_PATH} {
+        add_header Cache-Control "no-cache";
+        add_header X-Content-Type-Options nosniff;
+        try_files $uri $uri/ ${BASE_PATH}index.html;
+    }
+}
diff --git a/docker/smoke.sh b/docker/smoke.sh
new file mode 100755
index 0000000..89be7ca
--- /dev/null
+++ b/docker/smoke.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+# Smoke-test a running image: ./docker/smoke.sh http://localhost:8080/
+set -eu
+url="${1:-http://localhost:8080/}"
+origin=$(printf '%s' "$url" | sed -E 's#(https?://[^/]+).*#\1#')
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+for i in $(seq 1 30); do curl -fs "$origin/healthz" >/dev/null && break; sleep 1; done
+curl -fsS "$origin/healthz" | grep -q ok || fail healthz
+
+html=$(curl -fsS "$url") || fail "index at $url"
+echo "$html" | grep -q '<div id="root"' || fail "no #root in index"
+
+# Every asset the page references must resolve.
+for a in $(echo "$html" | grep -oE '(src|href)="[^"]+\.(js|css|svg|png|webmanifest)"' | sed -E 's/^[a-z]+="//; s/"$//' | grep -v '^http'); do
+  case "$a" in /*) u="$origin$a" ;; *) u="$url$a" ;; esac
+  curl -fsS -o /dev/null "$u" || fail "asset $u"
+done
+
+curl -fsS "${url}sw.js" | grep -q . || fail sw.js
+curl -fsSI "${url}manifest.webmanifest" | grep -qi 'content-type: application/manifest+json' || fail "manifest content-type"
+curl -fsS "${url}some/deep/link" | grep -q '<div id="root"' || fail "SPA fallback"
+echo "smoke OK: $url"
diff --git a/index.html b/index.html
index f23f3b8..66dd06f 100644
--- a/index.html
+++ b/index.html
@@ -63,6 +63,15 @@
   </head>
   <body>
     <div id="root"></div>
+    <noscript>
+      <h1>COLLET — Dremel 8260 companion</h1>
+      <p>
+        Live battery, speed and temperature, speed control, and an accessory &amp; material speed
+        guide for the Dremel 8260 smart rotary tool — over Web Bluetooth, with no vendor account and
+        no cloud. It needs JavaScript and Chrome on Android or Chrome/Edge on desktop.
+      </p>
+      <p><a href="https://github.com/libreble/collet">Source and protocol documentation</a></p>
+    </noscript>
     <script type="module" src="/src/main.tsx"></script>
   </body>
 </html>
diff --git a/src/meta.ts b/src/meta.ts
index 97c38ae..d925e8e 100644
--- a/src/meta.ts
+++ b/src/meta.ts
@@ -20,6 +20,18 @@ function canonical(href: string) {
   el.setAttribute('href', href);
 }
 
+// Canonical URLs always point at the public app, also in self-hosted copies (any base path),
+// so search engines don't index those as duplicates.
+const CANONICAL_ROOT = 'https://libreble.github.io/collet/';
+
+function canonicalFor(pathname: string) {
+  const base = import.meta.env.BASE_URL;
+  const route = pathname.startsWith(base)
+    ? pathname.slice(base.length)
+    : pathname.replace(/^\//, '');
+  return CANONICAL_ROOT + route;
+}
+
 /** Set title + description + Open Graph/Twitter tags for the current route. */
 export function useDocumentMeta(title: string, description: string) {
   useEffect(() => {
@@ -29,6 +41,6 @@ export function useDocumentMeta(title: string, description: string) {
     upsert('property', 'og:description', description);
     upsert('name', 'twitter:title', title);
     upsert('name', 'twitter:description', description);
-    canonical(window.location.origin + window.location.pathname);
+    canonical(canonicalFor(window.location.pathname));
   }, [title, description]);
 }
diff --git a/vite.config.ts b/vite.config.ts
index af6c4ab..a3c4ce7 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -23,16 +23,22 @@ function pagesSpaFallback(): Plugin {
 
 // COLLET is a fully local PWA: no backend, no analytics, no cloud.
 // Served from the /collet/ subpath on GitHub Pages (https://libreble.github.io/collet/).
+// Self-hosters override it: `BASE_PATH=/ npm run build` (the Docker image does this).
+const base = `/${(process.env.BASE_PATH ?? '/collet/').replace(/^\/+|\/+$/g, '')}/`.replace(
+  '//',
+  '/',
+);
+
 export default defineConfig({
-  base: '/collet/',
+  base,
   plugins: [
     react(),
     VitePWA({
       registerType: 'autoUpdate',
       manifest: {
-        id: '/collet/',
-        start_url: '/collet/',
-        scope: '/collet/',
+        id: base,
+        start_url: base,
+        scope: base,
         name: 'COLLET — Dremel 8260 companion',
         short_name: 'COLLET',
         description:
@@ -57,7 +63,7 @@ export default defineConfig({
         // Precache the app shell, icons and the bundled guide data so the whole
         // guide works offline. The tool link is local BLE — no server needed.
         globPatterns: ['**/*.{js,css,html,svg,png,json,woff2}'],
-        navigateFallback: '/collet/index.html',
+        navigateFallback: `${base}index.html`,
       },
     }),
     pagesSpaFallback(),