Organize local infrastructure and Vault secrets by service ownership

infra/images/backend.Dockerfile

@@ -0,0 +1,22 @@
+ARG GO_IMAGE
+ARG VAULT_IMAGE
+FROM ${GO_IMAGE} AS build
+RUN apk add --no-cache protobuf protobuf-dev make
+WORKDIR /src
+COPY Makefile ./
+COPY backend ./backend
+RUN make generate-notifications
+ARG MODULE
+WORKDIR /src/backend/${MODULE}
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -trimpath -o /out/service .
+
+FROM ${VAULT_IMAGE}
+USER root
+COPY --from=build /out/service /usr/local/bin/service
+COPY infra/local/scripts/start-service.sh /usr/local/bin/start-service
+COPY infra/local/bff/runtime.yml /etc/sxchnge/bff.yml
+COPY infra/local/notifications/runtime.yml /etc/sxchnge/notifications.yml
+COPY backend/notifications/templates.example.json /etc/sxchnge/templates.json
+RUN mkdir -p /run/sxchnge && chown 100:1000 /run/sxchnge
+USER 100:1000
+ENTRYPOINT ["vault", "agent", "-config=/etc/agent/config.hcl"]