From fccc81a6cc787ad399013c21d63113a39ec81bc2 Mon Sep 17 00:00:00 2001
From: Justin Paul <justin@jpaul.me>
Date: Sat, 6 Jun 2026 11:03:07 -0400
Subject: [PATCH] Wire the frontend into the deploy stack and CI

Compose gains a frontend service; Caddy now routes / to frontend:3000 (keeping /api/* and /health* on the backend). CI builds and pushes a frontend image alongside the backend. Verified end-to-end on the deploy target: / serves the app, /api and /health still resolve through Caddy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>
---
 .gitea/workflows/build.yml | 23 +++++++++++++++++++++++
 deploy/Caddyfile           |  7 ++-----
 deploy/docker-compose.yml  | 11 +++++++++++
 3 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index cae4325..b582c49 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -38,3 +38,26 @@ jobs:
           tags: |
             ${{ env.IMAGE_BASE }}/backend:latest
             ${{ env.IMAGE_BASE }}/backend:${{ github.sha }}
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push frontend image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./frontend
+          push: true
+          tags: |
+            ${{ env.IMAGE_BASE }}/frontend:latest
+            ${{ env.IMAGE_BASE }}/frontend:${{ github.sha }}
diff --git a/deploy/Caddyfile b/deploy/Caddyfile
index c784da2..8cfb60d 100644
--- a/deploy/Caddyfile
+++ b/deploy/Caddyfile
@@ -15,11 +15,8 @@
 		reverse_proxy backend:8000
 	}
 
-	# Frontend (Next.js) — not yet deployed in Phase 0. Uncomment when it lands.
-	# handle {
-	#	reverse_proxy frontend:3000
-	# }
+	# Everything else -> the Next.js frontend.
 	handle {
-		respond "Provenance — Phase 0. Backend health at /health; frontend not yet deployed." 200
+		reverse_proxy frontend:3000
 	}
 }
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 75d5d33..b484163 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -57,6 +57,16 @@ services:
       start_period: 20s
     restart: unless-stopped
 
+  frontend:
+    build:
+      context: ../frontend
+      dockerfile: Dockerfile
+    environment:
+      NODE_ENV: production
+    depends_on:
+      - backend
+    restart: unless-stopped
+
   caddy:
     image: caddy:2
     ports:
@@ -72,6 +82,7 @@ services:
       - caddyconfig:/config
     depends_on:
       - backend
+      - frontend
     restart: unless-stopped
 
 volumes: