init

backend/Dockerfile

@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1.7
+# Build stage — cached deps, then app sources.
+FROM rust:1-bookworm AS builder
+WORKDIR /app
+
+ENV CARGO_TERM_COLOR=always
+ENV CARGO_INCREMENTAL=0
+
+COPY Cargo.toml Cargo.lock ./
+# Touch a stub main to allow dependency-only build for caching.
+RUN mkdir -p src && echo 'fn main() {}' > src/main.rs \
+    && cargo build --release \
+    && rm -rf src target/release/deps/smgw_pki_automator*
+
+COPY src ./src
+COPY migrations ./migrations
+RUN cargo build --release
+
+# Runtime stage — minimal Debian with TLS + xmlsec1 (for InitialConfigBuilder),
+# softhsm2 libs available at runtime when needed.
+FROM debian:bookworm-slim AS runtime
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        libssl3 \
+        xmlsec1 \
+        libsofthsm2 \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /opt/smgw
+COPY --from=builder /app/target/release/smgw-pki-automator /usr/local/bin/smgw-pki-automator
+
+ENV RUST_LOG=info
+ENV BIND_ADDR=0.0.0.0:8443
+EXPOSE 8443
+ENTRYPOINT ["/usr/local/bin/smgw-pki-automator"]