From 8586f46dad5021f7cdd7a82adf5869cb93f309a7 Mon Sep 17 00:00:00 2001
From: naps62-yolo <yolo-git-naps-pt@naps62.com>
Date: Sun, 24 May 2026 20:14:22 +0000
Subject: [PATCH] feat(maestro): Dockerfile for maestro-registry
 (Dokploy-ready)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Multi-stage build (rust:1-bookworm builder → debian:bookworm-slim
runtime) for the `maestro-registry` binary. Uses BuildKit cargo cache
mounts so subsequent rebuilds are fast.

Defaults `MAESTRO_REGISTRY_BIND_ADDR=0.0.0.0:8080` so the container
is reachable from a reverse proxy (Traefik, etc.) without any extra
config. Operator supplies `MAESTRO_TOKEN` as a platform secret; with
that set the binary needs no writable volume.

`.dockerignore` keeps `target/`, `worktrees/`, `.git/`, docs, and the
WIP `web/` out of the build context.

Verified: docker build succeeds; `docker run -e MAESTRO_TOKEN=...
-p 8080:8080 maestro-registry` boots and responds 200 on the cookie
auth endpoint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .dockerignore |  9 +++++++++
 Dockerfile    | 31 +++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 Dockerfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..ddaa9ab
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+target/
+worktrees/
+.git/
+.github/
+.claude/
+docs/
+web/
+*.md
+.env*
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b8b77b0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1.7
+#
+# Image for the `maestro-registry` binary.
+#
+# Build:  docker build -t maestro-registry .
+# Run:    docker run --rm -p 8080:8080 -e MAESTRO_TOKEN=<secret> maestro-registry
+#
+# On Dokploy: point at this Dockerfile, expose port 8080 (or whatever you
+# set MAESTRO_REGISTRY_BIND_ADDR to), and set MAESTRO_TOKEN as a secret env.
+# No persistent volume is required when MAESTRO_TOKEN is provided.
+
+FROM rust:1-bookworm AS builder
+WORKDIR /build
+COPY . .
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/build/target \
+    cargo build --release -p maestro-registry \
+ && cp /build/target/release/maestro-registry /maestro-registry
+
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /maestro-registry /usr/local/bin/maestro-registry
+
+# Default to all-interfaces so Dokploy / Traefik can reach the service.
+# Override via env on the platform.
+ENV MAESTRO_REGISTRY_BIND_ADDR=0.0.0.0:8080
+EXPOSE 8080
+
+ENTRYPOINT ["/usr/local/bin/maestro-registry"]