feat: integrate web-deps and move webclient to docker/web-client

deploy/docker/webclient/Dockerfile → docker/web-client/Dockerfile

@@ -1,3 +1,5 @@
+FROM --platform=linux/amd64 ghcr.io/rophy/rustdesk/web-deps:20260823-1 AS web-deps
+
 FROM --platform=linux/amd64 ubuntu:22.04 AS build
 
 ARG FLUTTER_VERSION=3.24.5
@@ -37,18 +39,29 @@
 RUN yarn install && yarn build
 
 WORKDIR /build/flutter
-ARG WEB_DEPS_SHA256=b66011c4fc066b90c46ba0c78884fe5d1a7e5a7fad3dce401300ad893de63818
-RUN wget -q -O /tmp/web_deps.tar.gz \
-      https://github.com/rustdesk/doc.rustdesk.com/releases/download/console/web_deps.tar.gz \
-    && echo "${WEB_DEPS_SHA256}  /tmp/web_deps.tar.gz" | sha256sum -c - \
-    && flutter pub get && flutter build web --release \
-    && tar xzf /tmp/web_deps.tar.gz -C build/web
+COPY --from=web-deps /web_deps.tar.gz /tmp/web_deps.tar.gz
+RUN flutter pub get && flutter build web --release \
+    && tar xzf /tmp/web_deps.tar.gz -C build/web \
+    && sh /build/docker/web-client/cache-bust.sh
 
 # --- Production stage ---
 FROM nginx:alpine
 
 COPY --from=build /build/flutter/build/web /usr/share/nginx/html
 
+# Prevent CDN/browser from caching mutable assets; let the Flutter service worker handle caching
+COPY <<'NGINX' /etc/nginx/conf.d/cache-control.conf
+server {
+    listen 80;
+    location / {
+        root /usr/share/nginx/html;
+        index index.html;
+        add_header Cache-Control "no-cache, must-revalidate";
+    }
+}
+NGINX
+RUN rm /etc/nginx/conf.d/default.conf
+
 COPY <<'EOF' /docker-entrypoint.d/90-rustdesk-config.sh
 #!/bin/sh
 set -e

deploy/docker/webclient/README.md → docker/web-client/README.md

@@ -9,7 +9,7 @@ Behind a reverse proxy with path-based routing (recommended):
 ```bash
 docker run -d -p 8080:80 \
   -e RUSTDESK_KEY=your-public-key \
-  rophy/rustdesk-webclient
+  ghcr.io/rophy/rustdesk/web-client
 ```
 
 The web client defaults to same-origin WebSocket paths `/hbbs` and `/hbbr`, with `ws://` or `wss://` selected automatically based on the page protocol. No host configuration needed.
@@ -22,14 +22,14 @@ docker run -d -p 8080:80 \
   -e RUSTDESK_HOST=ws://hbbs.example.com:21118 \
   -e RUSTDESK_RELAY=ws://hbbr.example.com:21119 \
   -e RUSTDESK_KEY=your-public-key \
-  rophy/rustdesk-webclient
+  ghcr.io/rophy/rustdesk/web-client
 
 # Secure WebSocket via TLS-terminating proxy
 docker run -d -p 8080:80 \
   -e RUSTDESK_HOST=wss://hbbs.example.com/hbbs \
   -e RUSTDESK_RELAY=wss://hbbr.example.com/hbbr \
   -e RUSTDESK_KEY=your-public-key \
-  rophy/rustdesk-webclient
+  ghcr.io/rophy/rustdesk/web-client
 ```
 
 Then open http://localhost:8080 in a browser.
@@ -52,7 +52,7 @@ The proxy must route WebSocket connections to hbbs/hbbr:
 |------|---------|----------|
 | `/hbbs` | hbbs:21118 | WebSocket |
 | `/hbbr` | hbbr:21119 | WebSocket |
-| `/` | webclient:80 | HTTP |
+| `/` | web-client:80 | HTTP |
 
 The proxy should terminate TLS and support WebSocket upgrade. Example with nginx:
 
@@ -76,4 +76,4 @@ location /hbbr {
 
 ## Source
 
-Built from [rophy/rustdesk](https://github.com/rophy/rustdesk) using [`deploy/docker/webclient/Dockerfile`](https://github.com/rophy/rustdesk/blob/master/deploy/docker/webclient/Dockerfile).
+Built from [rophy/rustdesk](https://github.com/rophy/rustdesk) using [`docker/web-client/Dockerfile`](https://github.com/rophy/rustdesk/blob/master/docker/web-client/Dockerfile).

docker/web-client/cache-bust.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -e
+
+WEB=build/web
+
+hash_bust() {
+  local file="$1" pattern="$2" target="$3"
+  local hash
+  hash=$(sha256sum "$file" | cut -c1-8)
+  grep -q "$pattern" "$target" || { echo "ERROR: '$pattern' not found in $target" >&2; exit 1; }
+  sed -i "s|$pattern|$pattern?v=$hash|g" "$target"
+}
+
+hash_bust "$WEB/libopus.js"         "./libopus.js"      "$WEB/js/dist/index.js"
+hash_bust "$WEB/libopus.wasm"       "libopus.wasm"      "$WEB/libopus.js"
+hash_bust "$WEB/js/dist/index.js"   "js/dist/index.js"  "$WEB/index.html"
+hash_bust "$WEB/js/dist/vendor.js"  "js/dist/vendor.js" "$WEB/index.html"