init

Dockerfile

@@ -0,0 +1,62 @@
+FROM golang:1.26-bookworm AS build
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY cmd/ cmd/
+COPY internal/ internal/
+COPY migrations/ migrations/
+COPY web/ web/
+
+RUN CGO_ENABLED=1 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags="-s -w" -o /out/update-server ./cmd/server
+RUN CGO_ENABLED=1 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath -ldflags="-s -w" -o /out/update-migrate ./cmd/migrate
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends ca-certificates sqlite3 tzdata \
+	&& rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --system --gid 10001 update-server \
+	&& useradd --system --uid 10001 --gid 10001 --home /nonexistent --shell /usr/sbin/nologin update-server
+
+WORKDIR /app
+
+COPY --from=build /out/update-server /usr/local/bin/update-server
+COPY --from=build /out/update-migrate /usr/local/bin/update-migrate
+COPY migrations/ ./migrations/
+COPY web/ ./web/
+
+RUN mkdir -p /data \
+	&& chown -R update-server:update-server /app /data
+
+ENV APP_ADDR=0.0.0.0:8080 \
+	DATA_DIR=/data \
+	SQLITE_PATH=/data/db.sqlite \
+	ARTIFACTS_DIR=/data/artifacts \
+	MIGRATIONS_DIR=/app/migrations \
+	TEMPLATES_DIR=/app/web/templates \
+	STATIC_DIR=/app/web/static \
+	TRUST_PROXY_HEADERS=true \
+	APP_READ_TIMEOUT=30s \
+	APP_READ_HEADER_TIMEOUT=5s \
+	APP_WRITE_TIMEOUT=60s \
+	APP_IDLE_TIMEOUT=120s \
+	APP_MAX_HEADER_BYTES=1048576 \
+	APP_LOGIN_RATE_LIMIT_PER_MINUTE=10 \
+	APP_LOGIN_RATE_LIMIT_BURST=5 \
+	APP_CLIENT_RATE_LIMIT_PER_MINUTE=120 \
+	APP_CLIENT_RATE_LIMIT_BURST=60
+
+VOLUME ["/data"]
+EXPOSE 8080
+
+USER update-server:update-server
+
+ENTRYPOINT ["update-server"]
+