feat: deploy admin panel to stage

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: Build the application
-FROM node:20-alpine AS build
+FROM node:24-alpine AS build
 
 # Set working directory
 WORKDIR /app
@@ -7,6 +7,13 @@ WORKDIR /app
 # Copy package.json and yarn.lock
 COPY package.json yarn.lock ./
 
+# Vite embeds these values into the static bundle at build time. When an
+# argument is omitted, the checked-in .env remains the fallback.
+ARG VITE_API_URL
+ARG VITE_GEO_API_URL
+ARG VITE_WEATHER_API_URL
+ARG VITE_KRBL_MEDIA
+
 # Install dependencies
 RUN yarn install --frozen-lockfile
 
@@ -14,19 +21,23 @@ RUN yarn install --frozen-lockfile
 COPY . .
 
 # Build the application
-RUN yarn build
+RUN if [ -n "${VITE_API_URL:-}" ]; then export VITE_API_URL; fi && \
+    if [ -n "${VITE_GEO_API_URL:-}" ]; then export VITE_GEO_API_URL; fi && \
+    if [ -n "${VITE_WEATHER_API_URL:-}" ]; then export VITE_WEATHER_API_URL; fi && \
+    if [ -n "${VITE_KRBL_MEDIA:-}" ]; then export VITE_KRBL_MEDIA; fi && \
+    yarn build
 
 # Stage 2: Serve the application with Nginx
-FROM nginx:alpine
+FROM nginxinc/nginx-unprivileged:alpine
 
 # Copy the built application from the build stage
 COPY --from=build /app/dist /usr/share/nginx/html
 
-# Copy nginx configuration (optional, can be added later if needed)
-# COPY nginx.conf /etc/nginx/conf.d/default.conf
+# Keep client-side routes working on direct navigation and page refresh.
+COPY nginx.conf /etc/nginx/conf.d/default.conf
 
-# Expose port 80
-EXPOSE 80
+# The unprivileged image cannot bind to port 80.
+EXPOSE 8080
 
 # Start Nginx server
-CMD ["nginx", "-g", "daemon off;"]
+CMD ["nginx", "-g", "daemon off;"]