feat: implement CDN URL support for asset loading and add replacement script

Dockerfile.fips.standalone-infisical

@@ -2,6 +2,8 @@ ARG POSTHOG_HOST=https://app.posthog.com
 ARG POSTHOG_API_KEY=posthog-api-key
 ARG INTERCOM_ID=intercom-id
 ARG CAPTCHA_SITE_KEY=captcha-site-key
+# CDN URL placeholder - replaced at container startup with actual CDN_URL env var
+ARG CDN_URL=__INFISICAL_CDN_URL__
 
 FROM node:20.19.5-trixie-slim AS base
 
@@ -36,6 +38,8 @@ ARG INFISICAL_PLATFORM_VERSION
 ENV VITE_INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION
 ARG CAPTCHA_SITE_KEY
 ENV VITE_CAPTCHA_SITE_KEY $CAPTCHA_SITE_KEY
+ARG CDN_URL
+ENV VITE_CDN_URL $CDN_URL
 
 ENV NODE_OPTIONS="--max-old-space-size=8192"
 
@@ -185,8 +189,10 @@ COPY --from=backend-runner /app /backend
 
 COPY --from=frontend-runner /app ./backend/frontend-build
 
-# Make export-assets script executable for CDN asset extraction
-RUN chmod +x /backend/scripts/export-assets.sh
+# Copy CDN URL replacement script for runtime CDN URL replacement
+COPY frontend/scripts/replace-standalone-build-variable.sh /backend/scripts/replace-standalone-build-variable.sh
+RUN chmod +x /backend/scripts/export-assets.sh /backend/scripts/replace-standalone-build-variable.sh
+RUN chown -R non-root-user:nodejs /backend/frontend-build
 
 ARG INFISICAL_PLATFORM_VERSION
 ENV INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION

Dockerfile.standalone-infisical

@@ -2,6 +2,8 @@ ARG POSTHOG_HOST=https://app.posthog.com
 ARG POSTHOG_API_KEY=posthog-api-key
 ARG INTERCOM_ID=intercom-id
 ARG CAPTCHA_SITE_KEY=captcha-site-key
+# CDN URL placeholder - replaced at container startup with actual CDN_URL env var
+ARG CDN_URL=__INFISICAL_CDN_URL__
 
 FROM node:20.19.5-trixie-slim AS base
 
@@ -38,6 +40,8 @@ ENV INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION
 ENV VITE_INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION
 ARG CAPTCHA_SITE_KEY
 ENV VITE_CAPTCHA_SITE_KEY $CAPTCHA_SITE_KEY
+ARG CDN_URL
+ENV VITE_CDN_URL $CDN_URL
 ENV NODE_OPTIONS="--max-old-space-size=8192"
 
 # Build
@@ -174,8 +178,10 @@ ENV CAPTCHA_SITE_KEY=$CAPTCHA_SITE_KEY
 COPY --from=backend-runner /app /backend
 COPY --from=frontend-runner /app ./backend/frontend-build
 
-# Make export-assets script executable for CDN asset extraction
-RUN chmod +x /backend/scripts/export-assets.sh
+# Copy CDN URL replacement script for runtime CDN URL replacement
+COPY frontend/scripts/replace-standalone-build-variable.sh /backend/scripts/replace-standalone-build-variable.sh
+RUN chmod +x /backend/scripts/export-assets.sh /backend/scripts/replace-standalone-build-variable.sh
+RUN chown -R non-root-user:nodejs /backend/frontend-build
 
 ARG INFISICAL_PLATFORM_VERSION
 ENV INFISICAL_PLATFORM_VERSION $INFISICAL_PLATFORM_VERSION

frontend/scripts/replace-standalone-build-variable.sh

@@ -10,7 +10,13 @@ fi
 
 echo "Replacing pre-baked value.."
 
+# Replace in JS files in assets directory
 find assets -type f -name "*.js" |
 while read file; do
     sed -i "s|$ORIGINAL|$REPLACEMENT|g" "$file"
 done
+
+# Replace in index.html (for asset references)
+if [ -f "index.html" ]; then
+    sed -i "s|$ORIGINAL|$REPLACEMENT|g" "index.html"
+fi

frontend/vite.config.ts

@@ -29,14 +29,14 @@ export default defineConfig(({ mode }) => {
     "0.0.1"
   ).replaceAll(".", "-");
 
-  // Optional CDN URL for static assets (e.g., https://cdn.example.com)
-  // When set, all static assets will be served from this URL instead of the same origin.
-  // This is useful for serving assets from a CDN subdomain while keeping API calls on the main domain.
-  // If not set, assets are served from the same origin (backward compatible).
+  // CDN URL for static assets in /assets/* only.
+  // Docker: Set CDN_URL env var at runtime (placeholder replaced at container startup).
+  // Direct build: Use --build-arg CDN_URL=https://... or VITE_CDN_URL env var.
+  // Default: Empty = same-origin asset loading.
   const cdnUrl = env.VITE_CDN_URL || "";
 
   return {
-    base: cdnUrl || "/",
+    base: "/",
     server: {
       allowedHosts,
       host: true,
@@ -59,6 +59,15 @@ export default defineConfig(({ mode }) => {
         }
       }
     },
+    experimental: {
+      // Only apply CDN URL to files in /assets/* directory
+      renderBuiltUrl(filename) {
+        if (filename.startsWith("assets/")) {
+          return `${cdnUrl}/${filename}`;
+        }
+        return `/${filename}`;
+      }
+    },
     plugins: [
       tsconfigPaths(),
       nodePolyfills({

standalone-entrypoint.sh

@@ -2,4 +2,10 @@
 
 update-ca-certificates
 
+if [ -d "/backend/frontend-build/assets" ]; then
+    cd /backend/frontend-build
+    /backend/scripts/replace-standalone-build-variable.sh "__INFISICAL_CDN_URL__" "${CDN_URL:-}"
+    cd /backend
+fi
+
 exec node --enable-source-maps dist/main.mjs