feat(docker): fail at start when AUTH_HOST or API_HOST is unset

An empty host gives a CSP connect-src that blocks every API call.
The new entrypoint check stops the container early with a clear error.

Dockerfile

@@ -12,8 +12,7 @@ RUN npm run build
 # Serve the static files using a lightweight web server
 FROM nginx:alpine
 COPY --from=builder /app/dist /usr/share/nginx/html
-# nginx.conf is a template. An env var that is not set stays in it as ${...}, and nginx then fails to start.
+COPY --chmod=0755 docker-entrypoint.d/10-require-hosts.sh /docker-entrypoint.d/
-ENV AUTH_HOST="" API_HOST=""
 COPY nginx.conf /etc/nginx/templates/default.conf.template
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]

README.md

@@ -405,7 +405,8 @@ Production image (container env, read by nginx at start):
 | `AUTH_HOST` | Auth host name for the CSP `connect-src` |
 | `API_HOST` | Core host name, same |
 
-Both default to empty in the image; `docker-compose.yml` of the Deployment repo passes them. `FRONTEND_HOST` is not
+The image refuses to start when either is unset or empty (`docker-entrypoint.d/10-require-hosts.sh`);
+`docker-compose.yml` of the Deployment repo passes both. `FRONTEND_HOST` is not
 passed to the frontend image; compose uses it for the Traefik rule and as `APP_FRONTEND_URL` of Auth and Core (Deployment `docker-compose.yml`:68,152).
 
 ## Tests and build

docker-entrypoint.d/10-require-hosts.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Empty hosts would give a CSP connect-src that blocks every API call. Runs before 20-envsubst-on-templates.sh.
+: "${AUTH_HOST:?set AUTH_HOST (public host name of Auth) in the container env}"
+: "${API_HOST:?set API_HOST (public host name of Core) in the container env}"