From 3ac56b2c5b7528aab80fac3c90165c38d16dd948 Mon Sep 17 00:00:00 2001
From: patsy <pmjjacobs@gmail.com>
Date: Fri, 26 Jun 2026 14:39:38 +0200
Subject: [PATCH] deploy: add Dockerfile, fix gunicorn bind to 0.0.0.0

---
 Dockerfile       | 22 ++++++++++++++++++++++
 gunicorn.conf.py |  2 +-
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 Dockerfile

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..f3398e5
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,22 @@
+FROM python:3.13-slim
+
+# Non-root user for security
+RUN useradd --system --create-home --home-dir /app checkpoint
+
+WORKDIR /app
+
+# Dependencies first (layer caching — reinstall only when requirements change)
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# App code
+COPY . .
+
+# instance/ is a Docker volume — just ensure the directory exists with right owner
+RUN mkdir -p instance/uploads && chown -R checkpoint:checkpoint /app
+
+USER checkpoint
+
+EXPOSE 8000
+
+CMD ["gunicorn", "-c", "gunicorn.conf.py", "wsgi:app"]
\ No newline at end of file
diff --git a/gunicorn.conf.py b/gunicorn.conf.py
index c40ff92..1c3b2c9 100644
--- a/gunicorn.conf.py
+++ b/gunicorn.conf.py
@@ -5,7 +5,7 @@ Start (über systemd, siehe deploy/checkpoint.service):
 """
 
 # Nur lokal lauschen – nginx ist der öffentliche Eingang (Reverse Proxy).
-bind = "127.0.0.1:8000"
+bind = "0.0.0.0:8000"
 
 # Klein halten: 17 Nutzer, ein VPS. Mehrere Worker sind dank SQLite-WAL ok.
 workers = 3