phase 16: nginx-unprivileged on 8080, helm dashboard deployment

frontend/Dockerfile

@@ -9,9 +9,9 @@ ARG VITE_SYMBOL_REGISTRY_URL=""
 ARG VITE_RISK_ENGINE_URL=""
 RUN npm run build
 
-# Stage 2: Serve
-FROM nginx:alpine
+# Stage 2: Serve (unprivileged nginx, runs as uid 101, port 8080)
+FROM nginxinc/nginx-unprivileged:alpine
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
-EXPOSE 80
+EXPOSE 8080
 CMD ["nginx", "-g", "daemon off;"]

frontend/nginx.conf

@@ -1,5 +1,5 @@
 server {
-    listen 80;
+    listen 8080;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;

infra/helm/stonks-oracle/templates/ingress.yaml

@@ -123,5 +123,5 @@ spec:
               service:
                 name: dashboard
                 port:
-                  number: 80
+                  number: 8080
 {{- end }}

infra/helm/stonks-oracle/values.yaml

@@ -139,13 +139,13 @@ services:
     replicas: 1
     image: dashboard
     tier: frontend
-    port: 80
+    port: 8080
     resources:
       requests: { cpu: 50m, memory: 64Mi }
       limits: { cpu: 200m, memory: 128Mi }
     probes:
-      readiness: { path: /, port: 80, initialDelay: 3, period: 10 }
-      liveness: { path: /, port: 80, initialDelay: 5, period: 30 }
+      readiness: { path: /, port: 8080, initialDelay: 3, period: 10 }
+      liveness: { path: /, port: 8080, initialDelay: 5, period: 30 }
 
 ## ConfigMap data
 config: