Dashboard Deployment

The dashboard is deployed same-origin, path-prefixed — served under a path (e.g. /dashboard) on the same host as the API, not a separate subdomain. This means no reverse-proxy/BFF layer is needed in production: the browser’s session cookie and fetch calls to /auth/..., /orgs/..., etc. resolve directly against the current origin, and the ingress routes them to the right backend Service by path.

Caution

next.config.ts’s basePath and the browser-facing NEXT_PUBLIC_API_BASE are inlined into the client bundle at build time — they cannot be changed later via environment variables. The dashboard image must be built with the correct DASHBOARD_BASE_PATH/NEXT_PUBLIC_API_BASE build args for the environment it’s deployed to.

---

Docker Compose

The dashboard builds as its own service, published on its own host port (3001) rather than path-prefixed — the simplest local/demo topology:

dashboard:
  build:
    context: ./OpenTremor-dashboard
    args:
      NEXT_PUBLIC_API_BASE: http://localhost:8000
  ports:
    - "3001:3000"
  environment:
    API_BASE: http://opentremor-core:8000

NEXT_PUBLIC_API_BASE (build-time, browser-facing) points at the host-published API port; API_BASE (runtime, server-side) points at the API over the compose network.

Tip

Same-origin, path-prefixed deployment behind an ingress (production Kubernetes) is part of the separate OpenTremor Deployments repo’s Helm packaging, not this repo.

---

Domain-based deployment (this repo’s docker-compose.prod.yaml)

docker-compose.prod.yaml / haproxy/prod.cfg use a different topology from the one above: each app gets its own subdomain (opentremor.dev for the dashboard, api.opentremor.dev for the API) instead of being path-prefixed under one origin. NEXT_PUBLIC_API_BASE is built as the API’s absolute cross-origin URL rather than a relative path.

Because the dashboard and API no longer share an origin, two settings — not just one — must account for the split:

• CORS: opentremor-core-prod.yaml’s cors.allow_origins must list the dashboard’s real origin explicitly (a credentialed request can’t use *). Set at deploy time, file/env-driven.
• Session cookie domain: server.cookie_domain must be set to a suffix both hosts share (e.g. .opentremor.dev). Without it, the cookie set by POST /auth/session defaults to host-only on api.opentremor.dev: the browser stores it and login appears to succeed, but the dashboard’s server-side requests (on the other host) never see it, so every subsequent page load looks logged-out. Unlike server_dashboard_base_url, this one doesn’t need a manual PATCH /admin/settings call — set the SERVER_COOKIE_DOMAIN env var on the opentremor-core service (see docker-compose.prod.yaml) and it’s seeded into the platform settings automatically on first boot. A later PATCH /admin/settings always takes precedence if you need to change it afterwards. See the setup comment at the top of OpenTremor-core/configs/opentremor-core-prod.yaml for details.