WIP rebase onto upstream/clarin-v7: move customizations out of upstream files

Parks rebased work on a branch. Login is broken and needs investigation —
do not merge to clarin-dk-v7 until root-caused.

Restructured to keep upstream-tracked files (Dockerfile, docker-compose.yml)
byte-identical with upstream/clarin-v7. All CLARIN-DK deltas now live in
files we own:

  - docker/docker-compose.frontend.override.yml (new) — frontend compose deltas:
    * build with Dockerfile.dist (matches upstream's intended build path; the
      pm2 config lands at /app/dspace-ui.json, where upstream's compose
      entrypoint looks after ufal/dspace-angular#1060)
    * mem_limit: 2g (SSR leak cap; previously in docker-compose.yml)
    * DSPACE_UI_HOST=0.0.0.0 (upstream hard-codes the docker-network hostname,
      which doesn't fit our nginx-on-host reverse-proxy layout)
    * DSPACE_REST_PORT=443 (upstream defaults to :8080 which only works inside
      the docker network; we reach the backend via nginx at HTTPS :443)

  - Dockerfile: restored to upstream (dropped our yarn-install caching split;
    no longer used since we build with Dockerfile.dist)

  - docker/docker-compose.yml: restored to upstream (mem_limit and env
    defaults moved to the frontend override file)

Frontend compose invocation now requires the extra -f flag:

  docker compose -f docker-compose.yml -f docker-compose.frontend.override.yml up -d --build

README still documents the old single-file invocation — update before merging.

Known broken: login flow after this rebase. Backend unchanged, so the cause
is likely in the upstream frontend commits (137 of them) or in an interaction
with our Shibboleth/DiscoJuice customizations under src/aai/.

Author: simongray

Dockerfile

@@ -8,16 +8,13 @@ FROM docker.io/node:18-alpine
 RUN apk add --update python3 make g++ && rm -rf /var/cache/apk/*
 
 WORKDIR /app
+ADD . /app/
+EXPOSE 4000
 
-# Copy dependency manifests first so that yarn install is cached as long as deps don't change
-COPY package.json yarn.lock ./
 # We run yarn install with an increased network timeout (5min) to avoid "ESOCKETTIMEDOUT" errors from hub.docker.com
 # See, for example https://github.com/yarnpkg/yarn/issues/5540
 RUN yarn install --network-timeout 300000
 
-COPY . ./
-EXPOSE 4000
-
 # When running in dev mode, 4GB of memory is required to build & launch the app.
 # This default setting can be overridden as needed in your shell, via an env file or in docker-compose.
 # See Docker environment var precedence: https://docs.docker.com/compose/environment-variables/envvars-precedence/

docker/docker-compose.frontend.override.yml

@@ -0,0 +1,20 @@
+# CLARIN-DK frontend overrides. Merged on top of docker-compose.yml via:
+#   docker compose -f docker-compose.yml -f docker-compose.frontend.override.yml up -d --build
+# Keeps upstream's docker-compose.yml byte-identical.
+services:
+  dspace-angular:
+    # Use upstream's multi-stage "dist" Dockerfile — it's what upstream's entrypoint
+    # assumes (places dspace-ui.json at /app/dspace-ui.json). The plain Dockerfile
+    # puts the file at /app/docker/dspace-ui.json and no longer matches.
+    build:
+      dockerfile: Dockerfile.dist
+    # Cap SSR memory leak; pm2-runtime respawns the worker on OOM.
+    # TODO: investigate and fix the underlying SSR leak so this cap is no longer load-bearing.
+    mem_limit: 2g
+    environment:
+      # Listen on all interfaces in-container; nginx on the host reverse-proxies to 4001.
+      # Upstream hard-codes the docker-network hostname, which doesn't fit our nginx layout.
+      DSPACE_UI_HOST: '0.0.0.0'
+      # REST backend is reached via nginx at HTTPS :443, not directly at :8080.
+      # Upstream's default is 8080 which only makes sense inside the docker network.
+      DSPACE_REST_PORT: 443

docker/docker-compose.yml

@@ -15,24 +15,16 @@ services:
   dspace-angular:
     restart: unless-stopped
     container_name: dspace-angular${INSTANCE}
-    # Cap SSR memory leak; pm2-runtime respawns the worker on OOM.
-    # TODO: investigate and fix the underlying SSR memory leak so this cap is no longer load-bearing.
-    # TODO: revisit memory tuning for the other services — consider reducing the dspace -Xmx and
-    #       solr -m defaults (currently 4g each in docker-compose-rest.yml) and/or adding analogous
-    #       mem_limit caps on dspace and dspacesolr.
-    mem_limit: 2g
     environment:
       TZ: ${TIMEZONE:-Europe/Bratislava}
-      # UI runs plain HTTP on 0.0.0.0 inside container - nginx handles SSL termination
       DSPACE_UI_SSL: 'false'
-      DSPACE_UI_HOST: '0.0.0.0'
+      DSPACE_UI_HOST: dspace-angular
       # Use only `4000`, not the {UI_PORT} from the .env because in the container it is always `4000`
       DSPACE_UI_PORT: 4000
       DSPACE_UI_NAMESPACE: ${DSPACE_UI_NAMESPACE:-/}
-      # REST uses HTTPS since we call the external URL via nginx
       DSPACE_REST_SSL: ${DSPACE_SSL:-false}
       DSPACE_REST_HOST: ${DSPACE_HOST:-localhost}
-      DSPACE_REST_PORT: ${DSPACE_REST_PORT:-443}
+      DSPACE_REST_PORT: ${DSPACE_REST_PORT:-8080}
       DSPACE_REST_NAMESPACE: ${DSPACE_REST_NAMESPACE:-/server}
     image: ${DSPACE_UI_IMAGE:-ufal/dspace-angular:dspace-7_x}
     volumes: