add gitlab ci

backend/Dockerfile

@@ -0,0 +1,59 @@
+# syntax=docker/dockerfile:1
+
+ARG VERSION=dev
+ARG BUILD_DATE=unknown
+
+# --- builder: compile statique du binaire Go (CGO off, musl) ---
+FROM golang:1.26-alpine AS builder
+ENV GOTOOLCHAIN=auto
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ARG VERSION
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags "-s -w -X main.version=${VERSION}" \
+    -o /out/vaultdrop-server \
+    ./cmd/server/main.go
+
+# --- runtime: mince, Tesseract (fra+eng) embarqué pour l'OCR ---
+FROM alpine:3.20
+RUN apk add --no-cache \
+    ca-certificates \
+    tzdata \
+    tesseract-ocr \
+    tesseract-ocr-data-eng \
+    tesseract-ocr-data-fra
+
+WORKDIR /app
+
+ARG VERSION
+ARG BUILD_DATE
+LABEL org.opencontainers.image.title="vaultdrop-server" \
+      org.opencontainers.image.description="VaultDrop backend API (Go/Gin + PostgreSQL) — local-first document vault" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.licenses="AGPL-3.0-only" \
+      org.opencontainers.image.source="https://gitlab.com/thirdshop-org/dot" \
+      org.opencontainers.image.url="https://thirdshop.fr/en/applications/vault/" \
+      org.opencontainers.image.created="${BUILD_DATE}" \
+      org.opencontainers.image.revision=""
+
+COPY --from=builder /out/vaultdrop-server /usr/local/bin/vaultdrop-server
+
+# UPLOAD_DIR persistant, user non-root
+RUN mkdir -p /app/uploads \
+    && adduser -D -H -u 10001 vaultdrop \
+    && chown vaultdrop:vaultdrop /app/uploads
+VOLUME /app/uploads
+
+ENV PORT=8080 \
+    UPLOAD_DIR=/app/uploads
+
+USER vaultdrop
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
+    CMD wget -q -O - http://127.0.0.1:8080/api/v1/health || exit 1
+
+ENTRYPOINT ["vaultdrop-server"]