From 61357fd5fe7a1b4720ba7fe715a72e7c50397181 Mon Sep 17 00:00:00 2001
From: NetworkCats <networkcatlol@gmail.com>
Date: Mon, 2 Mar 2026 20:10:56 +0800
Subject: [PATCH] feat: add Dockerfile, docker-compose, and .dockerignore

---
 .dockerignore      |  7 +++++++
 .env.example       |  4 ++++
 Dockerfile         | 25 +++++++++++++++++++++++++
 docker-compose.yml | 41 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 77 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 Dockerfile
 create mode 100644 docker-compose.yml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..a442089
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+target
+.git
+.gitignore
+.env
+*.mmdb
+haproxy/certs
+AGENTS.md
diff --git a/.env.example b/.env.example
index e0d1def..899fea6 100644
--- a/.env.example
+++ b/.env.example
@@ -12,3 +12,7 @@ DB_UPDATE_INTERVAL_HOURS=24
 
 # Site domain name (used for display/metadata)
 SITE_DOMAIN=localhost
+
+# Path to the TLS certificate directory for HAproxy
+# The directory must contain origin.pem (combined cert + key)
+CERT_PATH=./haproxy/certs
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..75102f0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+FROM rust:1.92-slim AS builder
+
+WORKDIR /build
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+COPY templates ./templates
+COPY static ./static
+
+RUN cargo build --release
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd -r rustyip && useradd -r -g rustyip rustyip
+
+COPY --from=builder /build/target/release/rustyip /usr/local/bin/rustyip
+COPY --from=builder /build/templates /app/templates
+COPY --from=builder /build/static /app/static
+
+WORKDIR /app
+
+USER rustyip
+
+ENTRYPOINT ["rustyip"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..345db60
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,41 @@
+services:
+  haproxy:
+    image: haproxy:3.3.4
+    ports:
+      - "443:443"
+    volumes:
+      - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
+      - ${CERT_PATH:-./haproxy/certs}:/etc/haproxy/certs:ro
+    depends_on:
+      app:
+        condition: service_healthy
+    restart: unless-stopped
+    networks:
+      - internal
+
+  app:
+    build: .
+    environment:
+      - LISTEN_ADDR=0.0.0.0:3000
+      - DB_PATH=/data/Merged-IP.mmdb
+      - DB_UPDATE_URL=${DB_UPDATE_URL:-https://github.com/NetworkCats/Merged-IP-Data/releases/latest/download/Merged-IP.mmdb}
+      - DB_UPDATE_INTERVAL_HOURS=${DB_UPDATE_INTERVAL_HOURS:-24}
+      - SITE_DOMAIN=${SITE_DOMAIN:-localhost}
+    volumes:
+      - db_data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:3000/health || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    restart: unless-stopped
+    networks:
+      - internal
+
+volumes:
+  db_data:
+
+networks:
+  internal:
+    driver: bridge