ops: .dockerignore, non-root user, network isolation, deploy rollback

- .dockerignore excludes .git, node_modules, certs, *.zip
- Dockerfile runs as non-root appuser
- compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks
- deploy.sh snapshots binary before pull and rolls back on failed health check

.dockerignore

@@ -0,0 +1,8 @@
+.git
+node_modules
+web/dist
+certs
+*.zip
+dumpster-server
+.env
+.env.local

deploy.sh

@@ -8,8 +8,31 @@ export NVM_DIR="$HOME/.nvm"
 [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
 nvm use 22
 
+# Snapshot the current binary before pulling
+if [ -f dumpster-server ]; then
+  cp dumpster-server dumpster-server.bak
+  echo "Backed up existing binary to dumpster-server.bak"
+fi
+
 git pull
 make build
-systemctl restart dumpster
 
-echo "Deploy complete — $(date)"
+# Health check after restart — roll back on failure
+systemctl restart dumpster
+echo "Waiting for app to become healthy..."
+for i in $(seq 1 15); do
+  if curl -sf http://localhost:8080/ > /dev/null 2>&1; then
+    echo "Server is listening — deploy complete"
+    rm -f dumpster-server.bak
+    echo "Deploy complete — $(date)"
+    exit 0
+  fi
+  sleep 2
+done
+
+echo "Health check failed after 30s — rolling back..."
+systemctl stop dumpster
+cp dumpster-server.bak dumpster-server
+systemctl start dumpster
+echo "Rolled back to previous binary — $(date)"
+exit 1

docker/Dockerfile

@@ -16,8 +16,10 @@ RUN npm run build
 
 FROM alpine:latest
 RUN apk --no-cache add ca-certificates
+RUN adduser -D -g '' appuser
 WORKDIR /app
 COPY --from=go-builder /bin/dumpster-server /app/dumpster-server
 COPY --from=web-builder /app/dist /srv/web
+USER appuser
 EXPOSE 8080
-CMD ["sh", "-c", "if [ -z \"$DUMPSTER_SECRET\" ]; then export DUMPSTER_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 32); fi; /app/dumpster-server"]
+CMD sh -c "if [ -z \"$DUMPSTER_SECRET\" ]; then export DUMPSTER_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 32); fi; /app/dumpster-server"

docker/compose.yml

@@ -1,5 +1,9 @@
 version: '3.8'
 
+networks:
+  frontend:
+  backend:
+
 services:
   app:
     build:
@@ -32,6 +36,9 @@ services:
         condition: service_healthy
       valkey:
         condition: service_healthy
+    networks:
+      - frontend
+      - backend
 
   postgres:
     image: postgres:16
@@ -49,6 +56,8 @@ services:
       interval: 5s
       timeout: 5s
       retries: 5
+    networks:
+      - backend
 
   valkey:
     image: valkey/valkey:8
@@ -62,6 +71,8 @@ services:
       interval: 5s
       timeout: 3s
       retries: 5
+    networks:
+      - backend
 
   minio:
     image: minio/minio:latest
@@ -75,6 +86,8 @@ services:
       - "9001:9001"
     volumes:
       - minio_data:/data
+    networks:
+      - backend
 
   livekit:
     image: livekit/livekit-server:latest
@@ -89,6 +102,8 @@ services:
       - ./livekit.yaml:/etc/livekit.yaml:ro
     environment:
       LIVEKIT_KEYS: "${LIVEKIT_API_KEY:-devkey}: ${LIVEKIT_API_SECRET:-secret}"
+    networks:
+      - backend
 
   coturn:
     image: coturn/coturn:latest
@@ -110,6 +125,8 @@ services:
       - "50101-50200:50101-50200/udp"
     volumes:
       - /etc/letsencrypt:/etc/letsencrypt:ro
+    networks:
+      - backend
 
   caddy:
     image: caddy:2
@@ -124,6 +141,8 @@ services:
       - caddy_config:/config
     depends_on:
       - app
+    networks:
+      - frontend
 
 volumes:
   postgres_data: