build: build the console bundle from the cryptos-web monorepo

.github/workflows/ci-image.yaml

@@ -46,7 +46,7 @@ jobs:
       - name: 📥 Checkout web
         uses: actions/checkout@v4
         with:
-          repository: CryptOS-PKI/web
+          repository: CryptOS-PKI/cryptos-web
           ref: ${{ vars.WEB_RELEASE_REF || 'main' }}
           path: web
 

.github/workflows/job-release-image.yaml

@@ -38,7 +38,7 @@ jobs:
       - name: Checkout web (pinned)
         uses: actions/checkout@v4
         with:
-          repository: CryptOS-PKI/web
+          repository: CryptOS-PKI/cryptos-web
           ref: ${{ vars.WEB_RELEASE_REF }}
           path: web
 

Dockerfile

@@ -13,27 +13,33 @@
 # is what is pulled. Bump both together.
 
 # Stage 1: build the web bundle. The build context holds sibling checkouts of
-# the manager and web repos; the resulting dist is embedded by the Go stage.
+# the manager and web repos; the web repo is an npm workspaces monorepo, and
+# the console app's dist is embedded by the Go stage.
 FROM node:22-bookworm-slim@sha256:43ac6c60b8f89723f746e8a92ce91abd5017e627ce1ddfe4238355d3a30b772c AS web
 WORKDIR /web
+# The workspace manifests come first so the npm ci layer is cached until a
+# dependency changes.
 COPY web/package.json web/package-lock.json ./
+COPY web/apps/console/package.json apps/console/
+COPY web/packages/ui/package.json packages/ui/
+COPY web/packages/api-client/package.json packages/api-client/
 RUN npm ci
 COPY web/ ./
 ENV VITE_FLEET_MODE=live-auth
 # The SPA is served by the manager itself, so the API is same-origin. Without
-# this the fallback in web/src/lib/fleet/client.ts bakes http://localhost:8080
+# this the fallback in web/apps/console/src/lib/fleet/client.ts bakes http://localhost:8080
 # into the bundle and the shipped UI calls the operator's own machine.
 ARG VITE_FLEET_API=/
 ENV VITE_FLEET_API=${VITE_FLEET_API}
-RUN npm run build
+RUN npm run build -w @cryptos-pki/console
 
 # Stage 2: build the manager with the web bundle embedded.
 FROM golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d AS build
 WORKDIR /src
 COPY manager/go.mod manager/go.sum ./
 RUN go mod download
 COPY manager/ ./
-COPY --from=web /web/dist ./internal/webui/dist
+COPY --from=web /web/apps/console/dist ./internal/webui/dist
 # Build identity, stamped at link time (#81). A running manager has to be able
 # to say which build it is: the image copies the repo without a usable .git, so
 # nothing can derive this at runtime. Defaults keep a bare `docker build`

README.md

@@ -1,6 +1,6 @@
 # cryptos-manager 🛰️
 
-> 🎛️ The Fleet Manager backend for [CryptOS-PKI](https://github.com/CryptOS-PKI). Optional control plane that talks to many CryptOS CA nodes over mTLS gRPC and serves the [`web`](https://github.com/CryptOS-PKI/web) frontend at the same TLS listener.
+> 🎛️ The Fleet Manager backend for [CryptOS-PKI](https://github.com/CryptOS-PKI). Optional control plane that talks to many CryptOS CA nodes over mTLS gRPC and serves the [`cryptos-web`](https://github.com/CryptOS-PKI/cryptos-web) frontend at the same TLS listener.
 
 > [!WARNING]
 > 🚧 **Pre-1.0: any release can change fundamentally.** CryptOS is pre-1.0. Until v1.0.0, any release may change configuration, APIs, on-disk and state formats, trust setup, and upgrade paths, sometimes with no migration path. If you run it in production, you accept that risk. Read [each release's upgrade notes](https://github.com/CryptOS-PKI/cryptos-manager/releases) before you upgrade.
@@ -30,7 +30,7 @@ Once linked, the node's embedded operator surface becomes read-only and FM owns
 
 - 🐹 **Go backend**, served behind mTLS TLS 1.3.
 - 🐘 **Postgres** for cross-node inventory.
-- 📦 **Serves the [`web`](https://github.com/CryptOS-PKI/web) bundle** (pinned version, embedded via `embed.FS`) on the same listener as the FM gRPC API.
+- 📦 **Serves the [`cryptos-web`](https://github.com/CryptOS-PKI/cryptos-web) console bundle** (pinned version, embedded via `embed.FS`) on the same listener as the FM gRPC API.
 - ☸️ **Designed to run on Kubernetes** (Deployment + Service + Ingress, Helm chart shipped alongside the container image). Single-node Docker / `docker compose` is supported for small deployments; K8s is the primary target.
 
 ## 🚀 Deploying
@@ -158,7 +158,7 @@ supported path — and it stays useful afterwards for a patched build.
 ```sh
 mkdir -p src && cd src
 git clone https://github.com/CryptOS-PKI/cryptos-manager.git manager
-git clone https://github.com/CryptOS-PKI/web.git web
+git clone https://github.com/CryptOS-PKI/cryptos-web.git web
 manager/deploy/build-image.sh            # tags manager:local; IMAGE=... to change
 ```
 
@@ -314,7 +314,7 @@ The FleetService and BootstrapService API this manager serves is defined here, i
 ## 🧭 Companion repos
 
 - 🧠 [`cryptos-node`](https://github.com/CryptOS-PKI/cryptos-node) — the OS / engine that runs the CAs this FM manages, and the home of the node API (`cryptos.node.v1`) the FM calls.
-- 🎨 [`web`](https://github.com/CryptOS-PKI/web) — the FM's web frontend (served by this repo).
+- 🎨 [`cryptos-web`](https://github.com/CryptOS-PKI/cryptos-web) — the FM's web frontend (its `apps/console` bundle is served by this repo).
 
 ## 📄 License