Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

deploy/docker/Dockerfile

@@ -0,0 +1,84 @@
+# syntax=docker/dockerfile:1.7
+
+FROM node:24.18.1-bookworm-slim@sha256:235600a8101ab264e117b1768e925532262668dc9b581ef1dd7d96ced463b8e7 AS web-build
+WORKDIR /repo
+
+RUN corepack enable
+
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY src/frontend/package.json src/frontend/package.json
+COPY tests/e2e/package.json tests/e2e/package.json
+
+RUN pnpm install --filter @itworx/knowledge-hub-web... --frozen-lockfile
+
+COPY src/frontend src/frontend
+RUN pnpm --filter @itworx/knowledge-hub-web build
+
+# Canonical release identity (docs/adr/ADR-029-v2-r5-final-hardening.md): generated
+# here, not in the .NET SDK stage, because this is the one build stage that already
+# has both Node.js and the real built frontend output to hash — never a second,
+# independently-drifting source of truth. Computed only from what is actually inside
+# *this* build (source commit, the real docs/api/openapi.yaml, the real dist/ output);
+# deployment-time-only fields (image tag/ID/digest, deployment timestamp, migration
+# range) are deliberately left null here — see the script's own header comment.
+ARG BUILD_COMMIT=development
+ARG RELEASE_TAG=
+ARG IMAGE_REPOSITORY=itworx/knowledge-hub
+ARG IMAGE_TAG=
+COPY scripts/generate-release-manifest.mjs scripts/generate-release-manifest.mjs
+COPY docs/api/openapi.yaml docs/api/openapi.yaml
+RUN BUILD_COMMIT=${BUILD_COMMIT} RELEASE_TAG=${RELEASE_TAG} IMAGE_REPOSITORY=${IMAGE_REPOSITORY} IMAGE_TAG=${IMAGE_TAG} \
+    node scripts/generate-release-manifest.mjs /repo/release-manifest.json
+
+FROM mcr.microsoft.com/dotnet/sdk:10.0.302-noble@sha256:72dd743782f2ae7e5476fd64f6a460045e3998dc862218b80e6944cba79a01b0 AS backend-build
+WORKDIR /repo
+
+COPY global.json Directory.Build.props Directory.Build.targets Directory.Packages.props NuGet.Config .editorconfig ./
+COPY ItWorx.KnowledgeHub.slnx ./
+COPY src/backend src/backend
+COPY tests/backend tests/backend
+
+RUN dotnet restore ItWorx.KnowledgeHub.slnx
+RUN dotnet publish \
+    src/backend/ItWorx.KnowledgeHub.Api/ItWorx.KnowledgeHub.Api.csproj \
+    --configuration Release \
+    --no-restore \
+    --output /app/publish \
+    /p:UseAppHost=false
+
+RUN rm -rf /app/publish/wwwroot/*
+COPY --from=web-build /repo/src/frontend/dist /app/publish/wwwroot
+COPY --from=web-build /repo/release-manifest.json /app/publish/release-manifest.json
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0.11-noble@sha256:a4556ed033fa96f984bb7a8d348851cb2d36b1281dd2420070045f664fbb5f94 AS runtime
+
+ARG BUILD_COMMIT=development
+ENV ASPNETCORE_URLS=http://0.0.0.0:8080 \
+    DOTNET_EnableDiagnostics=0 \
+    Build__Commit=${BUILD_COMMIT}
+
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --gid 10001 knowledgehub \
+    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin knowledgehub \
+    && mkdir -p \
+        /app \
+        /var/lib/knowledge-hub/data \
+        /var/lib/knowledge-hub/attachments \
+        /var/lib/knowledge-hub/imports \
+        /var/lib/knowledge-hub/exports \
+        /var/lib/knowledge-hub/backups \
+        /var/lib/knowledge-hub/keys \
+    && chown -R 10001:10001 /app /var/lib/knowledge-hub
+
+WORKDIR /app
+COPY --from=backend-build --chown=10001:10001 /app/publish ./
+
+USER 10001:10001
+EXPOSE 8080
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=10 \
+  CMD ["curl", "--fail", "--silent", "--show-error", "http://127.0.0.1:8080/health/live"]
+
+ENTRYPOINT ["dotnet", "ItWorx.KnowledgeHub.Api.dll"]