ops: .dockerignore, non-root user, network isolation, deploy rollback

- .dockerignore excludes .git, node_modules, certs, *.zip
- Dockerfile runs as non-root appuser
- compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks
- deploy.sh snapshots binary before pull and rolls back on failed health check

docker/Dockerfile

@@ -16,8 +16,10 @@ RUN npm run build
 
 FROM alpine:latest
 RUN apk --no-cache add ca-certificates
+RUN adduser -D -g '' appuser
 WORKDIR /app
 COPY --from=go-builder /bin/dumpster-server /app/dumpster-server
 COPY --from=web-builder /app/dist /srv/web
+USER appuser
 EXPOSE 8080
-CMD ["sh", "-c", "if [ -z \"$DUMPSTER_SECRET\" ]; then export DUMPSTER_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 32); fi; /app/dumpster-server"]
+CMD sh -c "if [ -z \"$DUMPSTER_SECRET\" ]; then export DUMPSTER_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 32); fi; /app/dumpster-server"

docker/compose.yml

@@ -1,5 +1,9 @@
 version: '3.8'
 
+networks:
+  frontend:
+  backend:
+
 services:
   app:
     build:
@@ -32,6 +36,9 @@ services:
         condition: service_healthy
       valkey:
         condition: service_healthy
+    networks:
+      - frontend
+      - backend
 
   postgres:
     image: postgres:16
@@ -49,6 +56,8 @@ services:
       interval: 5s
       timeout: 5s
       retries: 5
+    networks:
+      - backend
 
   valkey:
     image: valkey/valkey:8
@@ -62,6 +71,8 @@ services:
       interval: 5s
       timeout: 3s
       retries: 5
+    networks:
+      - backend
 
   minio:
     image: minio/minio:latest
@@ -75,6 +86,8 @@ services:
       - "9001:9001"
     volumes:
       - minio_data:/data
+    networks:
+      - backend
 
   livekit:
     image: livekit/livekit-server:latest
@@ -89,6 +102,8 @@ services:
       - ./livekit.yaml:/etc/livekit.yaml:ro
     environment:
       LIVEKIT_KEYS: "${LIVEKIT_API_KEY:-devkey}: ${LIVEKIT_API_SECRET:-secret}"
+    networks:
+      - backend
 
   coturn:
     image: coturn/coturn:latest
@@ -110,6 +125,8 @@ services:
       - "50101-50200:50101-50200/udp"
     volumes:
       - /etc/letsencrypt:/etc/letsencrypt:ro
+    networks:
+      - backend
 
   caddy:
     image: caddy:2
@@ -124,6 +141,8 @@ services:
       - caddy_config:/config
     depends_on:
       - app
+    networks:
+      - frontend
 
 volumes:
   postgres_data: