Merge pull request #267 from gosuda/feature/remove-ssr

Feature/remove ssr

Author: gosunuts

.dockerignore

@@ -11,6 +11,10 @@ bin/
 docs/
 *.md
 
+# Local relay/tunnel state
+.portal-certs/
+*identity.json
+
 # IDE
 .vscode/
 .idea/
@@ -34,5 +38,6 @@ coverage.html
 vendor/
 
 # Frontend deps/build artifacts
+frontend/
 node_modules/
 **/node_modules/

.env.example

@@ -1,20 +1,24 @@
 # Public routing, discovery, and relay identity persistence
-PORTAL_URL=https://localhost:4017
-BOOTSTRAPS=https://localhost:4017
+PORTAL_URL=https://localhost
 DISCOVERY=true
 IDENTITY_PATH=/portal-certs
 
-# Listener ports
-API_PORT=4017
-SNI_PORT=443
+# Public edge and internal listener ports.
+# nginx owns HTTP_PORT/HTTPS_PORT and forwards to the internal relay/frontend services.
+HTTP_PORT=80
+HTTPS_PORT=443
 WIREGUARD_PORT=51820
+# Relay API and SNI TCP ports are fixed inside the Compose network at 4017 and 443.
+# nginx reads these paths inside its container. Defaults map to ./.portal-certs on the host.
+NGINX_CERT_FILE=/etc/nginx/certs/fullchain.pem
+NGINX_CERT_KEY=/etc/nginx/certs/privatekey.pem
 # Set when enabling public UDP or raw TCP lease ports.
 MIN_PORT=0
 MAX_PORT=0
 UDP_ENABLED=false
 TCP_ENABLED=false
 
-# Supported managed values: cloudflare, gcloud, hetzner, route53, vultr.
+# Supported managed values: cloudflare, gcloud, hetzner, njalla, route53, vultr.
 # Reused for ACME DNS-01, managed A records, ECH HTTPS records, and optional ENS DNS automation.
 ACME_DNS_PROVIDER=
 
@@ -42,22 +46,29 @@ AWS_DNSSEC_KMS_KEY_ARN=
 # Vultr DNS settings (required when ACME_DNS_PROVIDER=vultr)
 VULTR_API_KEY=
 
+# Njalla DNS settings (required when ACME_DNS_PROVIDER=njalla)
+NJALLA_TOKEN=
+
 # ENS gasless DNS import automation. When enabled, Portal uses ACME_DNS_PROVIDER
 # for DNSSEC and ENS TXT automation, even when certificate files are managed manually.
 ENS_GASLESS_ENABLED=false
 
-# Admin/auth configuration. The admin secret is generated and stored in IDENTITY_PATH/identity.json.
-LANDING_PAGE_ENABLED=false
+# Admin/auth configuration. The relay identity wallet is always allowed.
+ADMIN_WALLETS=
 # Enable when the relay is behind nginx/ingress/load balancers and should trust forwarded client IP headers.
 # Optionally restrict which proxy source ranges may supply those headers; leave empty for default private/loopback proxy ranges.
-TRUST_PROXY_HEADERS=false
+TRUST_PROXY_HEADERS=true
 TRUSTED_PROXY_CIDRS=
 
+# Frontend-owned presentation state.
+# Bundled Compose stores the saved override under ./.portal-certs/frontend-state/state.json.
+LANDING_PAGE_ENABLED=false
+
 # Optional: auto-generated thumbnail screenshots for tunnel apps without a thumbnail.
-# Requires the headless-shell sidecar (chromedp/headless-shell) in docker-compose.
-# Leave empty or remove to disable. See docs/src/routes/deployment/+page.md.
+# Used by the portal-api service. Requires the headless-shell sidecar.
+# Leave empty to keep generated screenshots disabled. See docs/src/routes/deployment/+page.md.
 # HEADLESS_SHELL_URL=ws://headless-shell:9222
 
 X402_FACILITATOR_ENABLED=false
 X402_NETWORK=eip155:84532
-X402_RPC_URL=https://base-sepolia-rpc.publicnode.com
+X402_RPC_URL=https://base-sepolia-rpc.publicnode.com

.github/workflows/branch-artifacts.yml

@@ -14,7 +14,6 @@ on:
 env:
   BUILD_REF: ${{ inputs.ref || github.ref_name }}
   REGISTRY: ghcr.io
-  IMAGE_NAME: gosuda/portal
   PLATFORMS: linux/amd64,linux/arm64
 
 concurrency:
@@ -23,7 +22,7 @@ concurrency:
 
 jobs:
   build:
-    name: Build Binaries
+    name: Build Artifacts
     runs-on: ubuntu-latest
 
     steps:
@@ -52,9 +51,17 @@ jobs:
           echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"
           echo "commit_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
           {
-            echo "image_tags<<EOF"
-            echo "${REGISTRY}/${IMAGE_NAME}:branch-${safe_ref}"
-            echo "${REGISTRY}/${IMAGE_NAME}:branch-${safe_ref}-${short_sha}"
+            echo "portal_image_tags<<EOF"
+            echo "${REGISTRY}/gosuda/portal:branch-${safe_ref}"
+            echo "${REGISTRY}/gosuda/portal:branch-${safe_ref}-${short_sha}"
+            echo "EOF"
+            echo "frontend_image_tags<<EOF"
+            echo "${REGISTRY}/gosuda/portal-frontend:branch-${safe_ref}"
+            echo "${REGISTRY}/gosuda/portal-frontend:branch-${safe_ref}-${short_sha}"
+            echo "EOF"
+            echo "portal_api_image_tags<<EOF"
+            echo "${REGISTRY}/gosuda/portal-api:branch-${safe_ref}"
+            echo "${REGISTRY}/gosuda/portal-api:branch-${safe_ref}-${short_sha}"
             echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
@@ -71,18 +78,51 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build and push Docker image
+      - name: Build and push portal Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: ${{ env.PLATFORMS }}
+          push: true
+          tags: ${{ steps.meta.outputs.portal_image_tags }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ steps.meta.outputs.commit_sha }}
+            org.opencontainers.image.ref.name=${{ env.BUILD_REF }}
+          cache-from: type=gha,scope=portal
+          cache-to: type=gha,mode=max,scope=portal
+
+      - name: Build and push frontend Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./frontend
+          file: ./frontend/Dockerfile
+          platforms: ${{ env.PLATFORMS }}
+          push: true
+          tags: ${{ steps.meta.outputs.frontend_image_tags }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ steps.meta.outputs.commit_sha }}
+            org.opencontainers.image.ref.name=${{ env.BUILD_REF }}
+          cache-from: type=gha,scope=frontend
+          cache-to: type=gha,mode=max,scope=frontend
+
+      - name: Build and push portal API Docker image
         uses: docker/build-push-action@v6
         with:
+          context: ./frontend
+          file: ./frontend/Dockerfile
+          target: api
           platforms: ${{ env.PLATFORMS }}
           push: true
-          tags: ${{ steps.meta.outputs.image_tags }}
+          tags: ${{ steps.meta.outputs.portal_api_image_tags }}
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.revision=${{ steps.meta.outputs.commit_sha }}
             org.opencontainers.image.ref.name=${{ env.BUILD_REF }}
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=portal-api
+          cache-to: type=gha,mode=max,scope=portal-api
 
       - name: Build binaries
         shell: bash

.github/workflows/cd.yml

@@ -7,7 +7,6 @@ on:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_NAME: gosuda/portal
   PLATFORMS: linux/amd64,linux/arm64
 
 concurrency:
@@ -16,11 +15,28 @@ concurrency:
 
 jobs:
   build-and-push:
-    name: Build and Push Docker Image
+    name: Build and Push Docker Images
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: gosuda/portal
+            context: .
+            file: Dockerfile
+            cache_scope: portal
+          - image: gosuda/portal-frontend
+            context: ./frontend
+            file: ./frontend/Dockerfile
+            cache_scope: frontend
+          - image: gosuda/portal-api
+            context: ./frontend
+            file: ./frontend/Dockerfile
+            target: api
+            cache_scope: portal-api
 
     steps:
       - name: Checkout code
@@ -43,7 +59,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ${{ env.REGISTRY }}/${{ matrix.image }}
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
             type=semver,pattern={{version}}
@@ -54,12 +70,15 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.file }}
+          target: ${{ matrix.target }}
           platforms: ${{ env.PLATFORMS }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.cache_scope }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache_scope }}
 
   release-binaries:
     name: Build and Release Tunnel Binaries

.gitignore

@@ -11,9 +11,7 @@
 bin/
 chat
 
-cmd/relay-server/dist/app
 data/
-.portal-certs
 
 # Test binary, built with `go test -c`
 *.test
@@ -146,3 +144,7 @@ fabric.properties
 
 # Nested workspace (separate keyless_tls project; not part of the portal module)
 keyless_tls/
+
+# Local relay/tunnel state
+.portal-certs/
+*identity.json

Dockerfile

@@ -1,20 +1,5 @@
 # syntax=docker/dockerfile:1
 
-# Stage 1: Build frontend (Node.js)
-FROM --platform=$BUILDPLATFORM node:22-slim AS frontend-builder
-WORKDIR /src
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  make && rm -rf /var/lib/apt/lists/*
-
-COPY frontend ./frontend
-COPY utils ./utils
-COPY Makefile ./
-
-RUN --mount=type=cache,target=/root/.npm \
-  make build-frontend
-
-# Stage 2: Build Go artifacts
 FROM --platform=$BUILDPLATFORM golang:1 AS go-builder
 WORKDIR /src
 
@@ -25,8 +10,7 @@ COPY go.mod go.sum ./
 RUN --mount=type=cache,target=/go/pkg/mod go mod download
 
 COPY . .
-RUN rm -rf bin/
-COPY --from=frontend-builder /src/cmd/relay-server/dist/app ./cmd/relay-server/dist/app
+RUN rm -rf bin/ cmd/relay-server/dist && mkdir -p cmd/relay-server/dist && touch cmd/relay-server/dist/.gitkeep
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -35,7 +19,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
   make build-tunnel && \
   GOOS=${TARGETOS} GOARCH=${TARGETARCH} make build-server
 
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM gcr.io/distroless/static-debian12:nonroot AS runtime
 
 COPY --from=go-builder /src/bin/relay-server /usr/bin/relay-server
 

Makefile

@@ -16,11 +16,11 @@ help:
 	@echo "  make fmt               - Apply gofmt/goimports"
 	@echo "  make lint-auto         - Run autofix lint/format pipeline"
 	@echo "  make test              - Run Go tests"
-	@echo "  make build             - Build everything (frontend, tunnel, server)"
+	@echo "  make build             - Build Go tunnel and relay server artifacts"
 	@echo "  make build-frontend    - Build React frontend (Tailwind CSS 4)"
 	@echo "  make build-docs        - Build documentation site (SvelteKit)"
 	@echo "  make build-tunnel      - Build portal-tunnel binaries"
-	@echo "  make build-server      - Build Go relay server (frontend built separately)"
+	@echo "  make build-server      - Build Go relay server"
 	@echo "  make run               - Run relay server"
 	@echo "  make clean             - Remove build artifacts"
 
@@ -61,12 +61,11 @@ run:
 	./bin/relay-server
 
 # Convenience target
-build: build-frontend build-tunnel build-server
+build: build-tunnel build-server
 
 # Build React frontend with Tailwind CSS 4
 build-frontend:
 	@echo "[frontend] building React frontend..."
-	@mkdir -p cmd/relay-server/dist/app
 	@cd frontend && npm i && npm run build
 	@echo "[frontend] build complete"
 
@@ -97,8 +96,8 @@ build-server:
 
 clean:
 	rm -rf bin
-	rm -rf cmd/relay-server/dist/app
 	rm -rf cmd/relay-server/dist/tunnel
+	rm -rf frontend/dist
 
 # Run the uniformity probe. Extra flags are passed through after the target name:
 #   make load-test -- -clients 1000 -relays 5

README.md

@@ -109,7 +109,7 @@ cd portal-tunnel && cp .env.example .env
 docker compose up
 ```
 
-For public deployment with DNS automation (ACME), TCP/UDP port ranges, and admin settings, see [Deployment](docs/src/routes/deployment/+page.md).
+For public deployment with DNS automation (ACME), TCP/UDP port ranges, and relay policy, see [Deployment](docs/src/routes/deployment/+page.md).
 
 ## How End-to-End Encryption Works