add docker package

Dockerfile

@@ -0,0 +1,104 @@
+# syntax=docker/dockerfile:1
+
+# Prisma 7 supports Node 20.19+, 22.12+ and 24.x and prints an unsupported
+# warning on newer majors, so this tracks the current LTS rather than latest.
+ARG NODE_VERSION=24-slim
+ARG PNPM_VERSION=11.25.0
+
+# ---------------------------------------------------------------------------
+# base - shared runtime, with pnpm baked in so no stage fetches it later
+# ---------------------------------------------------------------------------
+FROM node:${NODE_VERSION} AS base
+ARG PNPM_VERSION
+ENV PNPM_HOME=/pnpm \
+    PATH=/pnpm:$PATH \
+    CHECKPOINT_DISABLE=1
+RUN corepack enable && corepack prepare pnpm@${PNPM_VERSION} --activate
+WORKDIR /app
+
+# ---------------------------------------------------------------------------
+# build - install, generate the Prisma client, compile all three packages
+# ---------------------------------------------------------------------------
+FROM base AS build
+
+# better-sqlite3's install step is `prebuild-install || node-gyp rebuild`, so a
+# toolchain has to exist for the fallback. It never reaches a runtime stage.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends python3 make g++ \
+ && rm -rf /var/lib/apt/lists/*
+
+# Manifests first: dependencies only reinstall when the lockfile actually moves.
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY apps/backend/package.json apps/backend/
+COPY apps/frontend/package.json apps/frontend/
+COPY packages/database/package.json packages/database/
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm install --frozen-lockfile
+
+COPY . .
+
+# `prisma generate` resolves datasource.url through prisma7.config.ts, so the
+# variable must exist - but generate only writes the client, it never connects.
+ENV DATABASE_URL="file:/tmp/build.db"
+RUN pnpm --filter database db:generate \
+ && pnpm --filter database build \
+ && pnpm --filter backend build \
+ && pnpm --filter frontend build
+
+# Everything is compiled, so drop devDependencies in place. Safe here because
+# every runtime import in both apps resolves to a production dependency; the
+# one devDependency reference, `import("vite")` in server.js, sits in the dev
+# branch that --prod never takes.
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
+    pnpm install --prod --frozen-lockfile
+
+# ---------------------------------------------------------------------------
+# backend - Express API. Not published to the host; the frontend proxies to it.
+# ---------------------------------------------------------------------------
+FROM base AS backend
+ENV NODE_ENV=production
+
+COPY --from=build /app /app
+
+# Applying migrations on boot keeps a fresh volume usable. `migrate deploy` only
+# applies migrations it has not already recorded, so restarts are a no-op.
+COPY <<'EOF' /usr/local/bin/blog-backend
+#!/bin/sh
+set -e
+cd /app/packages/database
+./node_modules/.bin/prisma migrate deploy
+cd /app/apps/backend
+exec node dist/index.js
+EOF
+RUN chmod +x /usr/local/bin/blog-backend
+
+# The SQLite file lives on a volume mounted here.
+RUN mkdir -p /data && chown node:node /data
+USER node
+WORKDIR /app/apps/backend
+
+# src/index.ts calls app.listen(3000) directly - env.PORT is parsed but unused.
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD ["node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+
+CMD ["blog-backend"]
+
+# ---------------------------------------------------------------------------
+# frontend - SSR server: renders / and /post/:slug, proxies /api to the backend
+# ---------------------------------------------------------------------------
+FROM base AS frontend
+ENV NODE_ENV=production \
+    PORT=5173 \
+    BACKEND_ORIGIN=http://backend:3000
+
+COPY --from=build /app /app
+
+USER node
+WORKDIR /app/apps/frontend
+
+EXPOSE 5173
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||5173)+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+
+CMD ["node", "server.js", "--prod"]