feat: use private network to call API in SSR

.github/workflows/ci.yml

@@ -55,9 +55,9 @@ jobs:
           include-hidden-files: true
 
   # ============================================
-  # JOB 2: Quality - lint + typecheck (runs in parallel with build)
+  # JOB 2: Quality and tests - lint + typecheck + unit tests (runs in parallel with build)
   # ============================================
-  quality:
+  quality-and-tests:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -80,6 +80,9 @@ jobs:
       - name: Run typecheck
         run: pnpm run typecheck
 
+      - name: Run unit tests
+        run: pnpm run test:unit
+
       - name: Install datagouv-components dependencies
         working-directory: ./datagouv-components
         run: pnpm install
@@ -93,7 +96,7 @@ jobs:
         run: pnpm run lint
 
   # ============================================
-  # JOB 3: E2E Tests (runs in parallel with quality)
+  # JOB 3: E2E Tests (runs in parallel with quality-and-tests)
   # ============================================
   e2e:
     needs: build
@@ -287,7 +290,7 @@ jobs:
   # JOB 4: Docker - build & push Docker image (automatic on main, manual on any branch)
   # ============================================
   docker:
-    needs: [quality, e2e]
+    needs: [quality-and-tests, e2e]
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
     permissions:
@@ -340,7 +343,7 @@ jobs:
   # JOB 5: Sentry - upload source maps (automatic on main, manual on any branch)
   # ============================================
   sentry:
-    needs: [quality, e2e]
+    needs: [quality-and-tests, e2e]
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
     steps:
@@ -375,7 +378,7 @@ jobs:
   # JOB 6: Publish datagouv-components (automatic on main, manual on any branch)
   # ============================================
   publish-datagouv-components:
-    needs: [quality, e2e]
+    needs: [quality-and-tests, e2e]
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
     steps:

README.md

@@ -92,7 +92,8 @@ This project uses [pnpm](https://pnpm.io/) instead of npm mostly for security re
 ### 🔧 Environment Variables
 
 **Key variables:**
-- `NUXT_PUBLIC_API_BASE`: Base URL for API calls
+- `NUXT_PUBLIC_API_BASE`: Base URL for API calls (used by the browser and to build links)
+- `NUXT_API_BASE_PRIVATE_NETWORK`: Private-network API base for server-side (SSR / Nitro) requests, to reach the API without going through the public internet. Falls back to `NUXT_PUBLIC_API_BASE` when unset.
 - `NUXT_PUBLIC_DEV_API_KEY`: API key for development environment  
 - `NUXT_APP_COMMIT_ID`: Git commit ID (auto-generated in dev mode)
 - `NUXT_PUBLIC_SENTRY_DSN`: Sentry DSN for error tracking

nuxt.config.ts

@@ -46,6 +46,10 @@ export default defineNuxtConfig({
   },
 
   runtimeConfig: {
+    // Private-network API base used for server-side (SSR / Nitro) requests, to reach the API
+    // without going through the public internet. Empty by default → falls back to `public.apiBase`.
+    // Override in production with NUXT_API_BASE_PRIVATE_NETWORK.
+    apiBasePrivateNetwork: '',
     crispIdentifier: '',
     crispKey: '',
     crispWebsiteId: '',

package.json

@@ -40,6 +40,7 @@
     "preview": "nuxt preview",
     "postinstall": "nuxt prepare",
     "prepare": "husky",
+    "test:unit": "vitest run",
     "test:e2e": "playwright test",
     "test:e2e:update-screenshots": "playwright test tests/homepage.spec.ts tests/edito/pages-editor.spec.ts --update-snapshots",
     "test:e2e:ui": "playwright test --ui",
@@ -118,6 +119,7 @@
     "sass-embedded": "^1.99.0",
     "tailwindcss": "^4.2.4",
     "typescript": "^5.9.3",
+    "vitest": "^4.1.7",
     "vue-component-type-helpers": "^3.2.7",
     "vue-tsc": "^3.2.7"
   }

plugins/api.ts

@@ -8,10 +8,21 @@ export default defineNuxtPlugin({
     const route = useRoute()
     const { t, locale } = useTranslation()
 
+    const publicApiBase = config.public.apiBase as string
+    // Only set on the server (private runtimeConfig keys aren't exposed to the client).
+    const privateNetworkApiBase = (config.apiBasePrivateNetwork as string) || ''
+
     const makeApi = (apiOptions: { sendJson: boolean, redirectOn404: boolean }) => {
       return $fetch.create({
-        baseURL: config.public.apiBase,
-        onRequest({ options }) {
+        baseURL: publicApiBase,
+        onRequest(context) {
+          const { options } = context
+          // On the server, route requests through the private-network API base (when configured)
+          // so SSR doesn't go over the public internet. ofetch runs onRequest before applying
+          // baseURL, so rewriting the (absolute) request here makes baseURL a no-op server-side.
+          if (import.meta.server && privateNetworkApiBase && typeof context.request === 'string') {
+            context.request = toServerApiUrl(context.request, publicApiBase, privateNetworkApiBase)
+          }
           if (apiOptions.sendJson) {
             options.headers.set('Content-Type', 'application/json')
           }