Normalize Railway upstream URL for web proxy

Dockerfile

@@ -1,17 +1,18 @@
 # syntax=docker/dockerfile:1
 
-FROM golang:1.22-bookworm AS build
+FROM golang:1.26.1-bookworm AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /out/urapt-server ./cmd/urapt-server \
+RUN mkdir -p /out/data/store \
+ && CGO_ENABLED=0 go build -ldflags="-s -w" -o /out/urapt-server ./cmd/urapt-server \
  && CGO_ENABLED=0 go build -ldflags="-s -w" -o /out/urapt ./cmd/urapt
 
 FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /out/urapt-server /usr/local/bin/urapt-server
+COPY --from=build --chown=nonroot:nonroot /out/data /data
 EXPOSE 8080
-VOLUME ["/data"]
 ENV URAPT_STORE_DIR=/data/store
 ENV URAPT_BASE_URL=http://localhost:8080
 USER nonroot:nonroot

urapt-web/.dockerignore

@@ -0,0 +1,9 @@
+node_modules
+dist
+.git
+.gitignore
+Dockerfile
+README.md
+*.tsbuildinfo
+.env
+.env.*

urapt-web/Caddyfile

@@ -0,0 +1,24 @@
+{
+	auto_https off
+}
+
+:{$PORT} {
+	root * /srv
+
+	handle /api/* {
+		reverse_proxy {$URAPT_UPSTREAM} {
+			header_up Host {upstream_hostport}
+		}
+	}
+
+	handle /apt/* {
+		reverse_proxy {$URAPT_UPSTREAM} {
+			header_up Host {upstream_hostport}
+		}
+	}
+
+	handle {
+		try_files {path} /index.html
+		file_server
+	}
+}

urapt-web/Dockerfile

@@ -0,0 +1,17 @@
+FROM node:20-alpine AS build
+WORKDIR /app
+
+RUN corepack enable && corepack prepare pnpm@10.32.1 --activate
+
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+
+COPY . .
+RUN pnpm build
+
+FROM caddy:2-alpine
+COPY --from=build /app/dist /srv
+COPY Caddyfile /etc/caddy/Caddyfile
+COPY docker-entrypoint.sh /usr/local/bin/urapt-web-entrypoint
+RUN chmod +x /usr/local/bin/urapt-web-entrypoint
+ENTRYPOINT ["/usr/local/bin/urapt-web-entrypoint"]

urapt-web/README.md

@@ -65,6 +65,23 @@ and `/apt` to `urapt-server`. No CORS, no server changes — the API base is jus
 pnpm build    # outputs dist/
 ```
 
+### Railway
+
+`urapt-web/` includes a Dockerfile for deploying the UI as a separate Railway
+service. The container builds the Vite app and serves it with Caddy, proxying
+`/api/*` and `/apt/*` to an existing `urapt-server` service.
+
+In Railway, create a new service from this repo with:
+
+- Root Directory: `urapt-web`
+- Environment variable: `URAPT_SERVER_URL=https://your-urapt-server.up.railway.app`
+
+A trailing slash is okay; the container normalizes it before starting Caddy.
+
+Do not set `VITE_API_BASE_URL` for this deployment; the UI should keep using the
+default same-origin `/api/v1` path.
+
+
 ### Caddy
 
 ```caddy

urapt-web/docker-entrypoint.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+if [ -z "${URAPT_SERVER_URL:-}" ]; then
+  echo "URAPT_SERVER_URL is required, e.g. https://urapt-production.up.railway.app" >&2
+  exit 1
+fi
+
+# Caddy reverse_proxy upstreams may only contain scheme, host, and port.
+# Railway/public URLs are often copied with a trailing slash; normalize that.
+URAPT_UPSTREAM="$URAPT_SERVER_URL"
+while [ "${URAPT_UPSTREAM%/}" != "$URAPT_UPSTREAM" ]; do
+  URAPT_UPSTREAM="${URAPT_UPSTREAM%/}"
+done
+export URAPT_UPSTREAM
+
+exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile

urapt-web/package.json

@@ -2,6 +2,7 @@
   "name": "urapt-web",
   "private": true,
   "version": "0.1.0",
+  "packageManager": "pnpm@10.32.1",
   "type": "module",
   "description": "Web UI for urapt-server (self-hosted APT repository server).",
   "scripts": {