halkyon/.dockerignore

# The Docker build context is the repository root. Nothing secret, local or bulky
# goes into it: the server's Dockerfile copies the whole halkyon_learn_server folder.

# Secrets and local state
halkyon_learn_server/config/passwords.yaml
halkyon_learn_server/.serverpod/
deploy/.env
**/*.log

# Tooling and build output
.git/
**/.dart_tool/
**/build/
.vscode/
.claude/

# Not needed to build the server
halkyon_learn_flutter/
docs/
NEXT.md
feat(deploy): Docker Compose stack for the instance Caddy, the Serverpod server and PostgreSQL 16 in deploy/. Only Caddy publishes ports; the server and Postgres are reachable only inside the Compose network (Docker bypasses ufw, and the server listens on every interface). Secrets come from deploy/.env as environment variables; there is no production passwords.yaml, and .dockerignore keeps local secrets out of the build context. The server image builds on Serverpod's template with an Ubuntu 24.04 runtime: complete glibc incl. libgcc_s for the SQLite libraries Serverpod 4 bundles, CA certificates, a non-root user, and exec so SIGTERM reaches the server. The scaffold's dev-only docker-compose.yaml is removed. Verified locally: image builds, all native libraries resolve, no passwords.yaml in the image, migrations apply at start, Caddy serves 200, port 8080 unreachable from the host, Postgres in UTC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-09-27 17:18:31 +02:00			`# The Docker build context is the repository root. Nothing secret, local or bulky`
			`# goes into it: the server's Dockerfile copies the whole halkyon_learn_server folder.`

			`# Secrets and local state`
			`halkyon_learn_server/config/passwords.yaml`
			`halkyon_learn_server/.serverpod/`
			`deploy/.env`
			`*/.log`

			`# Tooling and build output`
			`.git/`
			`**/.dart_tool/`
			`**/build/`
			`.vscode/`
			`.claude/`

			`# Not needed to build the server`
			`halkyon_learn_flutter/`
			`docs/`
			`NEXT.md`