Publish release images so the quick start does not compile the stack #107

To install SITMUN today, a user clones this repository with its eight submodules (.gitmodules) and compiles front, backend, and proxy locally. mbtiles is also compiled when the opt-in mbtiles profile is on. That is a developer setup. An end user should download one Compose bundle and pull images from a tested release.

Order: after #108, whose build produces these images. #106 can ship before this, using a tag and a local build.

Current state

• https://github.com/orgs/sitmun/packages lists three packages, all from 14–15 January 2020: npm frontend-core, npm frontend-gui, and Maven org.sitmun.sitmun-backend-core. There is no container image for front, backend, proxy, or mbtiles.
• RELEASE.md prefers one coordinated version but does not publish images or list compatible module versions.

Why a pulled image does not run yet

These are the blockers to resolve before the images are useful outside a checkout:

• front fixes its deployment path at build time. front/Dockerfile substitutes PUBLIC_BASE_PATH into apiUrl / apiBaseURL, the viewer <base href>, the service-worker scope, webpack publicPath, SITNA_BASE_URL, and --base-href. A single published image serves only the path it was built for. Decide: support / only, publish one image per path, or move these to runtime config.
• front bakes in the build environment. ENVIRONMENT (development / production) is a build arg. Decide which one the release publishes.
• backend and front read files from the checkout. backend mounts ./profiles/${SITMUN_CONFIG_DIR} as /usr/src/config, which holds the Liquibase changelog. front mounts ./front/config for the nginx template. The release must either bake these files into the images or ship them in the bundle.
• Secrets. Compose defaults SITMUN_USER_SECRET, MIDDLEWARE_SECRET, and SITMUN_MBTILES_JOB_HANDLE_SECRET to dev-only-insecure-* values. The release bundle must make the user set them, or say plainly that it is a demo.

Tasks

• Decide on PUBLIC_BASE_PATH and ENVIRONMENT for published front images.
• Make backend and front start without files mounted from the checkout, or include those files in the bundle.
• On a sitmun-application-stack/X.Y.Z tag, push front, backend, proxy, and mbtiles to GHCR (or Docker Hub) tagged X.Y.Z. Use the image built by Block merges that break the Docker Compose image build #108's workflow.
• Attach a release Compose file, with an example .env, that uses image: and no build:.
• Give every shipped module version X.Y.Z (as RELEASE.md prefers), or list compatible submodule versions in the release notes.
• Replace the end-user quick start with "download the bundle, set the secrets, docker compose up -d". The clone-and-build steps become the developer path.

Acceptance

• On a machine with only Docker, the release Compose bundle runs docker compose up -d without git and without building an image. The admin and viewer open at http://localhost:9000.

Out of scope: #18 (IIS artifacts without Docker) and #105 (one repository instead of eight submodules).

Related: #106, #108.