init

Dockerfile

@@ -0,0 +1,52 @@
+# Kadence — one image that serves the API and the web UI.
+#
+# Stage 1 builds the React/Material front end; stage 2 installs the Python
+# backend and copies those built files into `static/`, which FastAPI serves from
+# the same origin. One container, one port, no CORS to configure.
+
+# ---- stage 1: the web UI ---------------------------------------------------
+FROM node:22-alpine AS web
+
+WORKDIR /web
+COPY frontend/package.json frontend/package-lock.json* ./
+RUN npm ci --no-audit --no-fund || npm install --no-audit --no-fund
+
+COPY frontend/ ./
+RUN npm run build
+
+
+# ---- stage 2: the backend --------------------------------------------------
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    TZ=Europe/Moscow
+
+WORKDIR /app
+
+# Build deps for psycopg are already covered by the binary wheel; curl is here
+# for the healthcheck only.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl tzdata \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY backend/pyproject.toml ./
+COPY backend/app ./app
+RUN pip install --no-cache-dir \
+        "fastapi>=0.115" "uvicorn[standard]>=0.30" "sqlalchemy>=2.0" \
+        "psycopg[binary]>=3.2" "pydantic>=2.8" "pydantic-settings>=2.4" \
+        "httpx>=0.27" "beautifulsoup4>=4.12" "apscheduler>=3.10,<4" \
+        "python-dotenv>=1.0" "tzdata>=2024.1"
+
+COPY --from=web /web/dist ./static
+
+# The app writes nothing outside the database, so it can run unprivileged.
+RUN useradd --create-home --uid 10001 kadence && chown -R kadence:kadence /app
+USER kadence
+
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD curl -fsS http://localhost:8000/api/health || exit 1
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]