feat: robust cache busting on deployment

infrastructure/apisix-resources/routes/admin-web-app.yaml

@@ -7,7 +7,55 @@ metadata:
 spec:
   ingressClassName: apisix
   http:
-    - name: rule-1
+    # Static hashed assets — immutable cache (1 year)
+    - name: hashed-assets
+      priority: 20
+      match:
+        hosts:
+          - admin.54link-dev.upi.dev
+        paths:
+          - /assets/*
+      backends:
+        - serviceName: admin-web-app
+          servicePort: 80
+      plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "public, max-age=31536000, immutable"
+        - name: cors
+          enable: true
+          config:
+            allow_origins: "*"
+            allow_methods: "*"
+            allow_headers: "*"
+            expose_headers: "*"
+
+    # Service worker — never cache
+    - name: service-worker
+      priority: 15
+      match:
+        hosts:
+          - admin.54link-dev.upi.dev
+        paths:
+          - /sw.js
+      backends:
+        - serviceName: admin-web-app
+          servicePort: 80
+      plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "no-cache, no-store, must-revalidate"
+                Pragma: "no-cache"
+                Expires: "0"
+
+    # HTML pages and fallback — no cache
+    - name: html-no-cache
       priority: 10
       match:
         hosts:
@@ -18,6 +66,14 @@ spec:
         - serviceName: admin-web-app
           servicePort: 80
       plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "no-cache, no-store, must-revalidate"
+                Pragma: "no-cache"
+                Expires: "0"
         - name: cors
           enable: true
           config:

infrastructure/apisix-resources/routes/client-web-app.yaml

@@ -7,7 +7,55 @@ metadata:
 spec:
   ingressClassName: apisix
   http:
-    - name: rule-1
+    # Static hashed assets — immutable cache (1 year)
+    - name: hashed-assets
+      priority: 20
+      match:
+        hosts:
+          - app.54link-dev.upi.dev
+        paths:
+          - /assets/*
+      backends:
+        - serviceName: client-web-app
+          servicePort: 80
+      plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "public, max-age=31536000, immutable"
+        - name: cors
+          enable: true
+          config:
+            allow_origins: "*"
+            allow_methods: "*"
+            allow_headers: "*"
+            expose_headers: "*"
+
+    # Service worker — never cache
+    - name: service-worker
+      priority: 15
+      match:
+        hosts:
+          - app.54link-dev.upi.dev
+        paths:
+          - /sw.js
+      backends:
+        - serviceName: client-web-app
+          servicePort: 80
+      plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "no-cache, no-store, must-revalidate"
+                Pragma: "no-cache"
+                Expires: "0"
+
+    # HTML pages and fallback — no cache (forces fresh index.html on every deploy)
+    - name: html-no-cache
       priority: 10
       match:
         hosts:
@@ -19,6 +67,14 @@ spec:
           servicePort: 80
       websocket: true
       plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "no-cache, no-store, must-revalidate"
+                Pragma: "no-cache"
+                Expires: "0"
         - name: cors
           enable: true
           config:

infrastructure/apisix-resources/routes/pup-web-app.yaml

@@ -1,13 +1,61 @@
-# tenant-web-app
+# tenant-web-app (PUP)
 apiVersion: apisix.apache.org/v2
 kind: ApisixRoute
 metadata:
   name: 54link-tenant-web-app-route
   namespace: 54link-dev
 spec:
-  ingressClassName:  apisix
+  ingressClassName: apisix
   http:
-    - name: rule-1
+    # Static hashed assets — immutable cache (1 year)
+    - name: hashed-assets
+      priority: 20
+      match:
+        hosts:
+          - pup.54link-dev.upi.dev
+        paths:
+          - /assets/*
+      backends:
+        - serviceName: pup-web-app
+          servicePort: 80
+      plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "public, max-age=31536000, immutable"
+        - name: cors
+          enable: true
+          config:
+            allow_origins: "*"
+            allow_methods: "*"
+            allow_headers: "*"
+            expose_headers: "*"
+
+    # Service worker — never cache
+    - name: service-worker
+      priority: 15
+      match:
+        hosts:
+          - pup.54link-dev.upi.dev
+        paths:
+          - /sw.js
+      backends:
+        - serviceName: pup-web-app
+          servicePort: 80
+      plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "no-cache, no-store, must-revalidate"
+                Pragma: "no-cache"
+                Expires: "0"
+
+    # HTML pages and fallback — no cache
+    - name: html-no-cache
       priority: 10
       match:
         hosts:
@@ -18,10 +66,18 @@ spec:
         - serviceName: pup-web-app
           servicePort: 80
       plugins:
+        - name: response-rewrite
+          enable: true
+          config:
+            headers:
+              set:
+                Cache-Control: "no-cache, no-store, must-revalidate"
+                Pragma: "no-cache"
+                Expires: "0"
         - name: cors
           enable: true
           config:
             allow_origins: "*"
             allow_methods: "*"
             allow_headers: "*"
-            expose_headers: "*"
+            expose_headers: "*"

uis/admin/54link_admin/index.html

@@ -4,6 +4,9 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+    <meta http-equiv="Pragma" content="no-cache" />
+    <meta http-equiv="Expires" content="0" />
     <title>admin-portal-ui</title>
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />

uis/admin/54link_admin/nginx.conf

@@ -4,17 +4,46 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    # React SPA — all unknown paths fall back to index.html
+    # HTML entry point — never cache (forces browser to fetch latest on deploy)
+    location = /index.html {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
+        try_files $uri =404;
+    }
+
+    # React SPA — all unknown paths fall back to index.html (with no-cache)
     location / {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
         try_files $uri $uri/ /index.html;
     }
 
-    # Cache static assets
-    location ~* \.(js|css|woff2?|png|jpg|svg|ico)$ {
+    # Vite hashed assets (e.g. assets/index-a1b2c3d4.js) — cache forever
+    location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";
     }
 
+    # Other static assets (fonts, images, icons) — cache with revalidation
+    location ~* \.(woff2?|png|jpg|jpeg|gif|svg|ico|webp)$ {
+        expires 30d;
+        add_header Cache-Control "public, must-revalidate";
+    }
+
+    # manifest.json — short cache for PWA updates
+    location = /manifest.json {
+        add_header Cache-Control "no-cache, must-revalidate";
+    }
+
+    # Service worker — never cache (must always be fresh for update detection)
+    location = /sw.js {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
+    }
+
     gzip on;
-    gzip_types text/plain text/css application/javascript application/json;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
 }

uis/admin/tenant_admin/Dockerfile

@@ -1,13 +1,12 @@
-FROM node:20
-
+FROM node:20-alpine AS builder
 WORKDIR /app
-
 COPY package.json package-lock.json* .npmrc* ./
-
-RUN npm install
-
+RUN npm ci
 COPY . .
+RUN npm run build
 
-EXPOSE 5173
-
-CMD ["npm", "run", "dev"]
+FROM nginx:alpine
+COPY --from=builder /app/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]

uis/admin/tenant_admin/index.html

@@ -4,6 +4,9 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+    <meta http-equiv="Pragma" content="no-cache" />
+    <meta http-equiv="Expires" content="0" />
     <title>admin-portal-ui</title>
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />

uis/admin/tenant_admin/nginx.conf

@@ -0,0 +1,49 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # HTML entry point — never cache (forces browser to fetch latest on deploy)
+    location = /index.html {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
+        try_files $uri =404;
+    }
+
+    # React SPA — all unknown paths fall back to index.html (with no-cache)
+    location / {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Vite hashed assets (e.g. assets/index-a1b2c3d4.js) — cache forever
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Other static assets (fonts, images, icons) — cache with revalidation
+    location ~* \.(woff2?|png|jpg|jpeg|gif|svg|ico|webp)$ {
+        expires 30d;
+        add_header Cache-Control "public, must-revalidate";
+    }
+
+    # manifest.json — short cache for PWA updates
+    location = /manifest.json {
+        add_header Cache-Control "no-cache, must-revalidate";
+    }
+
+    # Service worker — never cache (must always be fresh for update detection)
+    location = /sw.js {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+        add_header Expires "0";
+    }
+
+    gzip on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+}

uis/client/web2/Dockerfile

@@ -1,14 +1,12 @@
-FROM node:20
-
+FROM node:20-alpine AS builder
 WORKDIR /app
-
-COPY package.json package-lock.json* ./
-
-RUN npm install
-
+COPY package.json package-lock.json* .npmrc* ./
+RUN npm ci
 COPY . .
+RUN npm run build
 
-EXPOSE 5173
-
-
-CMD ["npm", "run", "dev"]
+FROM nginx:alpine
+COPY --from=builder /app/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]