updated files for a prod env

backend/.dockerignore

@@ -0,0 +1,4 @@
+# Downloaded event media (18GB+) — runtime data written by the importer,
+# never needed at build time, and provided via a volume mount in compose.
+public/
+.git

backend/Dockerfile.prod

@@ -0,0 +1,26 @@
+# ---- build ----
+FROM golang:1.24 AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/vindn-backend ./cmd/server
+
+# ---- runtime ----
+# "static" (not "-nonroot") to match the existing root:root ownership of the
+# bind-mounted ./backend/public/storage host directory shared with the
+# frontend container — switching to a non-root UID here would need that
+# directory rechowned too, or every media download starts failing silently.
+FROM gcr.io/distroless/static-debian12
+
+# The imported event data and the site's audience are both German-local;
+# default to that instead of UTC so the twice-daily cron (see tasks/Cronjob.go)
+# actually fires at 06:00/18:00 German time, not UTC. distroless/static ships
+# tzdata, but time/tzdata is also embedded in the binary above for safety.
+ENV TZ=Europe/Berlin
+
+WORKDIR /app
+COPY --from=build /out/vindn-backend ./vindn-backend
+
+EXPOSE 8080
+ENTRYPOINT ["./vindn-backend"]

backend/cmd/server/main.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"log"
+	"net/http"
+	"os"
 	"whimsoc/vindn-backend/config"
 	"whimsoc/vindn-backend/models"
 	"whimsoc/vindn-backend/repositories"
@@ -9,9 +11,23 @@ import (
 	"whimsoc/vindn-backend/tasks"
 
 	"github.com/gofiber/fiber/v2"
+
+	// Embeds the IANA timezone database into the binary so TZ=Europe/Berlin
+	// (see docker-compose.yaml) resolves correctly even on a minimal runtime
+	// image that might not ship /usr/share/zoneinfo — the twice-daily cron
+	// schedule in tasks/Cronjob.go depends on this being right.
+	_ "time/tzdata"
 )
 
 func main() {
+	// The prod runtime image is distroless (no shell, no wget/curl), so
+	// Docker's HEALTHCHECK runs this binary in a second mode instead of a
+	// separate tool — see backend/Dockerfile.prod.
+	if len(os.Args) > 1 && os.Args[1] == "healthcheck" {
+		runHealthcheck()
+		return
+	}
+
 	// Lade .env
 	config.LoadEnv()
 
@@ -44,3 +60,10 @@ func main() {
 
 	log.Fatal(app.Listen(":" + config.GetEnv("PORT", "8080")))
 }
+
+func runHealthcheck() {
+	resp, err := http.Get("http://localhost:" + config.GetEnv("PORT", "8080") + "/health")
+	if err != nil || resp.StatusCode != http.StatusOK {
+		os.Exit(1)
+	}
+}