milestone 11: systemd and docker packaging, operator and architecture docs, config and api reference, docs drift guards

deploy/docker/Dockerfile

@@ -0,0 +1,33 @@
+# The binary is NOT compiled here. Build it first, from the repository root:
+#
+#   (cd web && npm ci && npm run build)
+#   zig build cross -Dweb-dist=web/dist -Doptimize=ReleaseSafe
+#
+# then build the image with the repository root as context:
+#
+#   docker build -t nxdns -f deploy/docker/Dockerfile .
+#
+# The builder stage stages the CA bundle (upstream DoH/DoT verification rescans
+# the system store; a scratch image without one breaks every TLS upstream) and
+# maps the buildx TARGETARCH onto the zig cross-target directory.
+
+FROM alpine:3.22 AS builder
+RUN apk add --no-cache ca-certificates
+ARG TARGETARCH
+COPY zig-out/cross /cross
+RUN mkdir -p /rootfs/etc/ssl/certs /rootfs/etc/nxdns /rootfs/var/lib/nxdns \
+    && cp /etc/ssl/certs/ca-certificates.crt /rootfs/etc/ssl/certs/ \
+    && case "${TARGETARCH:-amd64}" in \
+         amd64) cp /cross/x86_64-linux-musl/nxdns /rootfs/nxdns ;; \
+         arm64) cp /cross/aarch64-linux-musl/nxdns /rootfs/nxdns ;; \
+         *) echo "unsupported TARGETARCH '${TARGETARCH}'" >&2; exit 1 ;; \
+       esac \
+    && chown 65532:65532 /rootfs/var/lib/nxdns
+
+FROM scratch
+COPY --from=builder /rootfs/ /
+USER 65532:65532
+VOLUME /var/lib/nxdns
+EXPOSE 53/udp 53/tcp 8080 443 853
+ENTRYPOINT ["/nxdns"]
+CMD ["run"]