second commit

2026-06-04 15:44:48 +08:00
parent 4db6efb3a7
commit 8ac150bc7b
1275 changed files with 286124 additions and 0 deletions
@@ -0,0 +1,68 @@
+# GoChat Dockerfile — Multi-stage build with security hardening
+# Reference: Chatwoot docker/Dockerfile multi-stage pattern + security best practices
+
+# ========== Build Stage ==========
+FROM golang:1.24-alpine AS builder
+
+# Build arguments for version injection
+ARG VERSION=dev
+ARG COMMIT_SHA=unknown
+ARG BUILD_DATE=unknown
+
+WORKDIR /app
+
+# Install git for go mod download with private repos
+RUN apk add --no-cache git
+
+# Dependency layer — cached unless go.mod/go.sum change
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy source code
+COPY . .
+
+# Build with version info injected via ldflags
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -ldflags="-s -w \
+    -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
+    -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
+    -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
+    -o /gochat ./cmd/gochat/
+
+# Build worker binary (same source, --worker-only flag in main)
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -ldflags="-s -w \
+    -X github.com/gochat/gochat/internal/config.Version=${VERSION} \
+    -X github.com/gochat/gochat/internal/config.CommitSHA=${COMMIT_SHA} \
+    -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
+    -o /gochat-worker ./cmd/gochat/
+
+# ========== Production Stage ==========
+FROM alpine:3.21
+
+# Install runtime dependencies
+RUN apk --no-cache add ca-certificates tzdata curl &&     addgroup -S gochat && adduser -S gochat -G gochat
+
+WORKDIR /app
+
+# Copy binary and configs from builder
+COPY --from=builder /gochat /app/gochat
+COPY --from=builder /gochat-worker /app/gochat-worker
+COPY configs/ /app/configs/
+
+# Set ownership to non-root user
+RUN chown -R gochat:gochat /app
+
+# Switch to non-root user for security
+USER gochat
+
+# Health check — references the /health endpoint we will add
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3     CMD curl -f http://localhost:3000/health || exit 1
+
+EXPOSE 3000
+
+# Default entrypoint — can be overridden for worker mode:
+#   docker run gochat/gochat serve            → API server
+#   docker run gochat/gochat serve --worker-only → background worker
+ENTRYPOINT ["/app/gochat"]
+CMD ["serve"]