feat: add Dockerfile, docker-compose, and .dockerignore

.dockerignore

@@ -0,0 +1,7 @@
+target
+.git
+.gitignore
+.env
+*.mmdb
+haproxy/certs
+AGENTS.md

.env.example

@@ -12,3 +12,7 @@ DB_UPDATE_INTERVAL_HOURS=24
 
 # Site domain name (used for display/metadata)
 SITE_DOMAIN=localhost
+
+# Path to the TLS certificate directory for HAproxy
+# The directory must contain origin.pem (combined cert + key)
+CERT_PATH=./haproxy/certs

Dockerfile

@@ -0,0 +1,25 @@
+FROM rust:1.92-slim AS builder
+
+WORKDIR /build
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+COPY templates ./templates
+COPY static ./static
+
+RUN cargo build --release
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd -r rustyip && useradd -r -g rustyip rustyip
+
+COPY --from=builder /build/target/release/rustyip /usr/local/bin/rustyip
+COPY --from=builder /build/templates /app/templates
+COPY --from=builder /build/static /app/static
+
+WORKDIR /app
+
+USER rustyip
+
+ENTRYPOINT ["rustyip"]

docker-compose.yml

@@ -0,0 +1,41 @@
+services:
+  haproxy:
+    image: haproxy:3.3.4
+    ports:
+      - "443:443"
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+      - ${CERT_PATH:-./haproxy/certs}:/etc/haproxy/certs:ro
+    depends_on:
+      app:
+        condition: service_healthy
+    restart: unless-stopped
+    networks:
+      - internal
+
+  app:
+    build: .
+    environment:
+      - LISTEN_ADDR=0.0.0.0:3000
+      - DB_PATH=/data/Merged-IP.mmdb
+      - DB_UPDATE_URL=${DB_UPDATE_URL:-https://github.com/NetworkCats/Merged-IP-Data/releases/latest/download/Merged-IP.mmdb}
+      - DB_UPDATE_INTERVAL_HOURS=${DB_UPDATE_INTERVAL_HOURS:-24}
+      - SITE_DOMAIN=${SITE_DOMAIN:-localhost}
+    volumes:
+      - db_data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:3000/health || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    restart: unless-stopped
+    networks:
+      - internal
+
+volumes:
+  db_data:
+
+networks:
+  internal:
+    driver: bridge