Organize local infrastructure and Vault secrets by service ownership

infra/images/backend.Dockerfile

@@ -0,0 +1,22 @@
+ARG GO_IMAGE
+ARG VAULT_IMAGE
+FROM ${GO_IMAGE} AS build
+RUN apk add --no-cache protobuf protobuf-dev make
+WORKDIR /src
+COPY Makefile ./
+COPY backend ./backend
+RUN make generate-notifications
+ARG MODULE
+WORKDIR /src/backend/${MODULE}
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -trimpath -o /out/service .
+
+FROM ${VAULT_IMAGE}
+USER root
+COPY --from=build /out/service /usr/local/bin/service
+COPY infra/local/scripts/start-service.sh /usr/local/bin/start-service
+COPY infra/local/bff/runtime.yml /etc/sxchnge/bff.yml
+COPY infra/local/notifications/runtime.yml /etc/sxchnge/notifications.yml
+COPY backend/notifications/templates.example.json /etc/sxchnge/templates.json
+RUN mkdir -p /run/sxchnge && chown 100:1000 /run/sxchnge
+USER 100:1000
+ENTRYPOINT ["vault", "agent", "-config=/etc/agent/config.hcl"]

infra/images/frontend.Dockerfile

@@ -0,0 +1,17 @@
+ARG UBUNTU_IMAGE
+ARG CADDY_IMAGE
+FROM ${UBUNTU_IMAGE} AS build
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git unzip xz-utils libglu1-mesa && rm -rf /var/lib/apt/lists/*
+ARG FLUTTER_VERSION
+ARG FLUTTER_COMMIT
+RUN git clone --depth 1 --branch "${FLUTTER_VERSION}" https://github.com/flutter/flutter.git /opt/flutter && test "$(git -C /opt/flutter rev-parse HEAD)" = "${FLUTTER_COMMIT}"
+ENV PATH="/opt/flutter/bin:${PATH}"
+RUN flutter config --no-analytics && flutter precache --web
+WORKDIR /src
+COPY frontend ./frontend
+WORKDIR /src/frontend/app
+ARG FRONTEND_URL=https://localhost:5126
+RUN flutter pub get && flutter gen-l10n && flutter build web --no-wasm-dry-run --dart-define=SXCHNGE_API_URL=${FRONTEND_URL}/api/v1 --dart-define=SXCHNGE_CLIENT_ID=sxchnge-local-web
+FROM ${CADDY_IMAGE}
+COPY infra/local/frontend/Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /src/frontend/app/build/web /srv

infra/images/nats.Dockerfile

@@ -0,0 +1,10 @@
+ARG NATS_IMAGE
+ARG VAULT_IMAGE
+FROM ${NATS_IMAGE} AS nats
+FROM ${VAULT_IMAGE}
+USER root
+COPY --from=nats /nats-server /usr/local/bin/nats-server
+COPY infra/local/nats/start.sh /usr/local/bin/start-nats
+RUN mkdir -p /data /run/sxchnge && chown -R 100:1000 /data /run/sxchnge
+USER 100:1000
+ENTRYPOINT ["vault", "agent", "-config=/etc/agent/config.hcl"]

infra/images/tools.Dockerfile

@@ -0,0 +1,3 @@
+ARG DOCKER_IMAGE
+FROM ${DOCKER_IMAGE}
+RUN apk add --no-cache curl jq git openssl util-linux shellcheck