Student Welfare Management System

Role & context

1. 01

   Multi-stage Docker build

   the Node build toolchain stays in the build stage; the final image ships only static assets on nginx:stable-alpine (small runtime, low attack surface)

2. 02

   Reproducible installs

   npm ci against a committed package-lock.json so every build resolves identical versions

3. 03

   Pinned base images (node:13.12.0-alpine, nginx:stable-alpine) for deterministic builds

4. 04

   Production build hardening

   GENERATE_SOURCEMAP=false (no source disclosure, smaller output) and a raised Node heap to avoid OOM on the large CRA build

5. 05

   SPA-correct serving

   nginx try_files ... /index.html history fallback plus hashed, cache-friendly asset filenames

6. 06

   Role-based access in the app it serves

   JWT-based, fine-grained route guards (authRoles mapping pages to roles) backed by Keycloak OIDC

• The large Create React App build exhausted Node's heap and emitted source maps that leaked internals.

  FixRaised the heap with --max_old_space_size=4096 and disabled source maps via GENERATE_SOURCEMAP=false in the production build script.

• Client-side routes (React Router deep links) returned 404 when the static build was served by a plain web server on refresh.

  FixAdded an nginx try_files $uri $uri/ /index.html fallback so unmatched paths return the SPA shell and routing resolves on the client.