Snapshot: alpha-2026-9

deploy/prod/Dockerfile.backend

@@ -0,0 +1,33 @@
+# Production image for the Django backend.
+# Runs migrations then serves the app with gunicorn on port 8000.
+# Static files are collected at build time into /app/staticfiles and
+# served by the backend itself behind the host nginx reverse proxy.
+
+FROM python:3.11-slim
+
+# The build context here is just backend/ (no .git), so settings.py's own
+# `git rev-parse` fallback can't find a repo - the actual commit is passed
+# in from the real checkout via this build-arg instead (see playbook.yml).
+ARG GIT_COMMIT=unknown
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    DJANGO_SETTINGS_MODULE=backend.settings \
+    GIT_COMMIT=$GIT_COMMIT
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir -r requirements.txt gunicorn
+
+COPY . .
+
+# collectstatic only needs Django settings to import cleanly, not a real
+# secret; the actual SECRET_KEY is injected at container runtime via
+# --env-file and overrides this.
+RUN SECRET_KEY=build-time-placeholder python manage.py collectstatic --noinput
+
+EXPOSE 8000
+
+CMD ["sh", "-c", "python manage.py migrate --noinput && exec gunicorn backend.wsgi:application --bind 0.0.0.0:8000 --workers 3"]