Docker shit

docker/Dockerfile.backend

@@ -0,0 +1,66 @@
+# ============================================================
+# Dockerfile.backend — Backend only
+# ============================================================
+# Multi-stage build:
+#   1. chef    – install cargo-chef for dependency caching
+#   2. planner – generate a recipe.json from the workspace
+#   3. builder – build dependencies first (cached), then the backend binary
+#   4. runtime – minimal image with just the compiled binary
+# ============================================================
+
+# --------------- Stage 1: Chef base ---------------
+FROM rust:1-bookworm AS chef
+RUN cargo install cargo-chef
+WORKDIR /app
+
+# --------------- Stage 2: Planner ---------------
+FROM chef AS planner
+# Copy the full workspace so cargo-chef can resolve all dependencies
+COPY Cargo.toml Cargo.lock ./
+COPY src/ src/
+COPY backend/ backend/
+COPY frontend/ frontend/
+RUN cargo chef prepare --recipe-path recipe.json
+
+# --------------- Stage 3: Builder ---------------
+FROM chef AS builder
+
+# Cache dependency compilation in its own layer
+COPY --from=planner /app/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json -p backend
+
+# Now copy the real source and build
+COPY Cargo.toml Cargo.lock ./
+COPY src/ src/
+COPY backend/ backend/
+COPY frontend/ frontend/
+RUN cargo build --release -p backend
+
+# --------------- Stage 4: Runtime ---------------
+FROM debian:bookworm-slim AS runtime
+
+# Install TLS root certificates and PostgreSQL client libs (needed by sqlx
+# at runtime for TLS connections via native-tls)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends ca-certificates libssl3 && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Copy the compiled binary
+COPY --from=builder /app/target/release/backend /app/backend
+
+# Copy migrations so they can be run at startup if needed
+COPY backend/migrations/ /app/migrations/
+
+EXPOSE 8001
+
+# Environment variables should be provided at runtime via docker run --env
+# or docker compose environment/env_file.
+#
+# Required:
+#   DATABASE_URL    – PostgreSQL connection string
+#   TOKEN_SECRET    – JWT signing key
+#   ORIGIN          – Allowed CORS origin (frontend URL)
+
+CMD ["/app/backend"]