From c9c404aa01f9a0df19ecb05bce1c60c5a5ee7738 Mon Sep 17 00:00:00 2001
From: Steve Dudenhoeffer <steve@stevedudenhoeffer.com>
Date: Sat, 18 Jul 2026 15:35:15 -0400
Subject: [PATCH] Add Gitea Action to build and push the image for Komodo
 deploys

Multi-stage Dockerfile builds the web bundle, embeds it into the static
Go binary (CGO_ENABLED=0), and ships it in a minimal alpine runtime:
non-root user, ca-certificates + tzdata, SQLite on a /data volume,
healthcheck on /api/v1/healthz, OCI provenance labels.

build-image.yml pushes to the Gitea registry on every branch push:
  * main             -> :latest
  * any other branch -> :<branch-name> (sanitized to valid tag chars)
  * every build      -> :sha-<short>   (immutable, for pinning)

A push to a PR branch covers the PR, so there is no separate
pull_request trigger. README documents the image, tags, and a
docker run / Komodo compose snippet. Modeled on mort's CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
---
 .dockerignore                    | 26 ++++++++++++
 .gitea/workflows/build-image.yml | 73 ++++++++++++++++++++++++++++++++
 Dockerfile                       | 60 ++++++++++++++++++++++++++
 README.md                        | 39 +++++++++++++++++
 4 files changed, 198 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 .gitea/workflows/build-image.yml
 create mode 100644 Dockerfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..29c3b01
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,26 @@
+# VCS / editor / docs — not needed in the image build context.
+.git
+.gitea
+.github
+.idea
+.vscode
+*.md
+LICENSE
+
+# Local build outputs and databases.
+/pansy
+*.db
+*.db-wal
+*.db-shm
+
+# Frontend deps/output are rebuilt inside the image's web stage.
+web/node_modules
+web/dist
+
+# The embedded web build is produced fresh in the image (web stage → embed
+# directory), so never ship stale local contents. dist.go itself is kept.
+internal/webdist/dist
+
+# Assorted local scratch.
+.playwright-mcp
+.claude
diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
new file mode 100644
index 0000000..1a0448e
--- /dev/null
+++ b/.gitea/workflows/build-image.yml
@@ -0,0 +1,73 @@
+name: Build image
+
+# Build the single-binary image and push it to the Gitea container registry so
+# it can be deployed with Komodo. Tagging:
+#   * main            -> :latest
+#   * any other branch -> :<branch-name>   (sanitized to valid Docker tag chars)
+#   * every build also -> :sha-<short>      (immutable, handy for pinning)
+#
+# Runs on every branch push (so branch images are always available) and can be
+# triggered manually. A push to a PR branch covers the PR too, so there is no
+# separate pull_request trigger (avoids double builds).
+
+on:
+  push:
+    branches: ['**']
+  workflow_dispatch:
+
+concurrency:
+  group: build-image-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/pansy
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        run: |
+          REPO_URL="https://token:${{ github.token }}@gitea.stevedudenhoeffer.com/${{ github.repository }}.git"
+          git clone --depth=1 --branch "${{ github.ref_name }}" "$REPO_URL" .
+
+      - name: Set up Docker Buildx
+        run: docker buildx create --use --name pansy-builder --driver docker-container 2>/dev/null || docker buildx use pansy-builder
+
+      - name: Log in to Gitea registry
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
+
+      - name: Compute tags
+        id: meta
+        run: |
+          SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          if [ "${GITHUB_REF_NAME}" = "main" ]; then
+            PRIMARY="latest"
+          else
+            # Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-].
+            PRIMARY=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g' | sed 's/--*/-/g' | sed 's/^[-.]*//;s/-$//')
+          fi
+          TAGS="${IMAGE_NAME}:${PRIMARY},${IMAGE_NAME}:sha-${SHA_SHORT}"
+          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+          echo "Building tags: ${TAGS}"
+
+      - name: Build and push (linux/amd64)
+        run: |
+          TAG_FLAGS=""
+          IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}"
+          for tag in "${TAG_ARRAY[@]}"; do
+            TAG_FLAGS="$TAG_FLAGS --tag $tag"
+          done
+
+          docker buildx build \
+            --push \
+            --platform linux/amd64 \
+            $TAG_FLAGS \
+            --build-arg "BUILD_COMMIT=${GITHUB_SHA}" \
+            --build-arg "BUILD_BRANCH=${GITHUB_REF_NAME}" \
+            --build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
+            --file ./Dockerfile \
+            .
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..599db53
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,60 @@
+# syntax=docker/dockerfile:1
+#
+# pansy ships as one static binary with the web build embedded. This is a
+# three-stage build: compile the frontend, embed it into the Go binary, then
+# copy that single binary into a minimal runtime image.
+
+# ---- stage 1: build the web bundle ------------------------------------------
+FROM node:22-alpine AS web
+WORKDIR /web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/ ./
+RUN npm run build
+
+# ---- stage 2: build the static Go binary (web bundle embedded) --------------
+FROM golang:1.26-alpine AS build
+ENV CGO_ENABLED=0 GOTOOLCHAIN=auto
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+# Overlay the freshly built frontend into the embed directory before compiling
+# (//go:embed all:dist in internal/webdist).
+COPY --from=web /web/dist ./internal/webdist/dist
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go build -trimpath -ldflags "-s -w" -o /out/pansy ./cmd/pansy
+
+# ---- stage 3: minimal runtime -----------------------------------------------
+FROM alpine:3.20
+ARG BUILD_COMMIT=unknown
+ARG BUILD_BRANCH=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.title="pansy" \
+      org.opencontainers.image.description="Self-hostable garden planner" \
+      org.opencontainers.image.source="https://gitea.stevedudenhoeffer.com/steve/pansy" \
+      org.opencontainers.image.revision="${BUILD_COMMIT}" \
+      org.opencontainers.image.version="${BUILD_BRANCH}" \
+      org.opencontainers.image.created="${BUILD_TIME}"
+
+# ca-certificates: outbound TLS (OIDC discovery, #5). tzdata: correct local time.
+RUN apk add --no-cache ca-certificates tzdata \
+    && adduser -D -u 10001 pansy \
+    && mkdir -p /data \
+    && chown pansy:pansy /data
+
+COPY --from=build /out/pansy /usr/local/bin/pansy
+
+USER pansy
+# The SQLite database lives on the /data volume so it survives container updates.
+ENV PANSY_PORT=8080 \
+    PANSY_DB=/data/pansy.db
+WORKDIR /data
+VOLUME /data
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD wget -q -O - "http://127.0.0.1:${PANSY_PORT}/api/v1/healthz" || exit 1
+
+ENTRYPOINT ["/usr/local/bin/pansy"]
diff --git a/README.md b/README.md
index 5711d1c..e4ffd6d 100644
--- a/README.md
+++ b/README.md
@@ -58,3 +58,42 @@ All configuration is via environment variables; every value has a default, so `.
 | `PANSY_TRUSTED_PROXIES`   | *(none)*           | Comma-separated proxy CIDRs/IPs to trust for client-IP resolution. |
 
 Auth variables are read at startup now and consumed as the auth features land (issues #4/#5).
+
+## Docker & deployment
+
+CI (`.gitea/workflows/build-image.yml`) builds the single-binary image and pushes it to the Gitea registry on every branch push:
+
+| Ref | Tag |
+| --- | --- |
+| `main` | `gitea.stevedudenhoeffer.com/steve/pansy:latest` |
+| any other branch | `gitea.stevedudenhoeffer.com/steve/pansy:<branch-name>` |
+| every build | `gitea.stevedudenhoeffer.com/steve/pansy:sha-<short>` (immutable; use to pin) |
+
+The image runs as a non-root user, serves on `:8080`, and stores the SQLite database on the `/data` volume. Run it directly:
+
+```sh
+docker run -d --name pansy \
+  -p 8080:8080 \
+  -v pansy-data:/data \
+  gitea.stevedudenhoeffer.com/steve/pansy:latest
+```
+
+Or as a Komodo/Compose stack:
+
+```yaml
+services:
+  pansy:
+    image: gitea.stevedudenhoeffer.com/steve/pansy:${PANSY_TAG:-latest}
+    ports:
+      - "8080:8080"
+    volumes:
+      - pansy-data:/data
+    environment:
+      PANSY_BASE_URL: https://pansy.example.com
+      # PANSY_OIDC_ISSUER: ...   # once auth (#5) lands
+    restart: unless-stopped
+volumes:
+  pansy-data:
+```
+
+Pin `PANSY_TAG` to a `sha-<short>` tag for reproducible deploys, or leave it at `latest` to track `main`.