The previous commit made `pnpm --filter web start` load the repository-root
.env, which was the wrong file: Strapi reads a bare PORT as well
(apps/cms/config/server.ts uses env.int('PORT', 1337)), so one value there
would have moved the CMS onto the website's port the moment anyone exported
it - and the root .env is docker compose's file, whose WEB_PORT is a
published host port, not a listen port.
The web app now loads apps/web/.env, the way Strapi already loads
apps/cms/.env. PORT and HOST are per-application because they mean something
different to each server. apps/web/.env.example documents them together with
SITE_URL, STRAPI_URL and STRAPI_TOKEN, and warns against the VITE_ prefix,
which would inline a value into the client bundle - STRAPI_TOKEN lives in
that file.
Still no default port: with PORT unset, react-router-serve keeps its own
behaviour of taking the first free port from 3000 upwards. A real
environment variable wins over the file, so a systemd unit or a container
that injects PORT is unaffected.
.dockerignore now excludes .env at every depth, not only at the root.
`COPY apps/web ./apps/web` would otherwise have baked a developer's
apps/web/.env - STRAPI_TOKEN included - into the image.
Verified against the existing build: PORT=8140 HOST=127.0.0.1 in
apps/web/.env listens on 127.0.0.1:8140, and PORT=8141 in the environment
overrides the file while HOST still comes from it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
react-router-serve only honours a port it is given: with PORT unset it calls
getAvailablePort(3000) and takes the first free port from 3000 upwards
(@react-router/serve cli.js). Nothing in the manual path set PORT, so a
busy 3000 silently moved the site to 3001, 3002 and so on, and a reverse
proxy configured against one upstream stopped matching. Docker never showed
this because apps/web/Dockerfile and docker-compose.yml both set PORT=3000.
The web start script now always passes a port - PORT if exported, else
WEB_PORT from .env, else 3000 - so the manual path is as deterministic as
the containerised one and .env's WEB_PORT finally reaches the process that
binds. HOST is deliberately left undefaulted: react-router-serve reads it
directly, unset means every interface (what the container needs) and
127.0.0.1 restricts the socket to a proxy on the same host.
Verified against the existing build: PORT=8123 listens on *:8123, and
WEB_PORT=8124 HOST=127.0.0.1 listens on 127.0.0.1:8124 and serves /en with
a 200 while the CMS is down.
.env.example documents both variables, and the deployment section of
README.md gains a systemd unit, since nothing sources .env there, and a
warning that WEB_PORT is the published host port under Docker but the
listen port in manual mode.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Carries the 11 page drafts plus the shared SiteNav and SiteFooter onto the
project's own design system: tier-2 tokens, the published type roles, logical
properties throughout, and both locales.
Surfaces
- The page stands on #0B0B0A with #1D1D1B bands lifted off it, as the drafts
do; the body previously painted the band colour, so every band was a step
too light.
- A card is drawn one step off whatever it stands on (#1D1D1B on the ground,
#141413 inside a band). Components paint --surface-card and a band re-points
it for its subtree, so a card can never come out the same colour as its band.
Shell
- Nav: translucent ground with a blur, chevrons on group triggers, an accent
rule under the current section, the drafts' compact dropdown card, and an
EN | AR toggle in place of the globe menu.
- Footer: the drafts' four-column grid, one-line brand text, Facebook as a
bordered button, the EU lockup, the implemented-by row and the funding
disclaimer.
Pages
- Home: hero with counting figures, launch band, three areas of change,
newsroom, FAQ accordion and the consortium band.
- The nine interior pages rebuilt and then audited section by section against
their drafts.
- Applications: the three-step application form now posts real submissions to
the Strapi `application` type, validated server-side and working without
JavaScript.
Motion
- Every animation in the drafts, as classes in _page-kit/motion.css: staggered
entrances, scroll-driven reveals, the drifting washes (each page carries its
own geometry), the sheen, the counting figures and the accordion. The
drafts' coloured hover glow is deliberately not shipped.
CMS
- New `faq` collection type behind the home page's accordion.
- `role` added to the consortium member component so an editor can supply the
chip and the deliverable separately.
Content
- No invented figure, date, name or commitment ships: the five-working-day
reply, the placeholder email and Facebook handle, the sample news, events,
publications and FAQs, the invented application rules and the TBD counters
are all withheld pending real content. Figures that survived (3 consortium
partners, 4 areas of work, 16 human security sub-projects, Dec 2025 - Dec
2027) are verified against docs/ and the bundled draft copy.
Verified: pnpm typecheck (web + CMS) and pnpm --filter web build pass; all 20
page/locale URLs render 200 through the built SSR handler, including with the
CMS unreachable; no raw hex or physical-direction utility in components or
routes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
IllusionandClaude Opus 5