From e1c0daa2aa6ac0fd758ea696400f4364b1394e5e Mon Sep 17 00:00:00 2001
From: dahoud <dahoud@dgbf.ci>
Date: Wed, 10 Dec 2025 10:27:35 +0000
Subject: [PATCH] Add Dockerfile for lionsctl deployment

---
 Dockerfile | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)
 create mode 100644 Dockerfile

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..ccff9c8
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,91 @@
+####
+# Dockerfile de production pour UnionFlow Server (Backend)
+# Multi-stage build optimisé avec sécurité renforcée
+####
+
+## Stage 1 : Build avec Maven
+FROM maven:3.9.6-eclipse-temurin-17 AS builder
+
+WORKDIR /app
+
+# Copier les fichiers de configuration Maven
+COPY pom.xml .
+COPY ../unionflow-server-api/pom.xml ../unionflow-server-api/
+
+# Télécharger les dépendances (cache Docker)
+RUN mvn dependency:go-offline -B -pl unionflow-server-impl-quarkus -am
+
+# Copier le code source
+COPY src ./src
+
+# Construire l'application avec profil production
+RUN mvn clean package -DskipTests -B -Dquarkus.profile=prod -pl unionflow-server-impl-quarkus
+
+## Stage 2 : Image de production optimisée
+FROM registry.access.redhat.com/ubi8/openjdk-17:1.18
+
+ENV LANGUAGE='en_US:en'
+
+# Configuration des variables d'environnement pour production
+ENV QUARKUS_PROFILE=prod
+ENV QUARKUS_HTTP_PORT=8085
+ENV QUARKUS_HTTP_HOST=0.0.0.0
+
+# Configuration Base de données (à surcharger via variables d'environnement)
+ENV DB_URL=jdbc:postgresql://postgresql:5432/unionflow
+ENV DB_USERNAME=unionflow
+ENV DB_PASSWORD=changeme
+
+# Configuration Keycloak/OIDC (production)
+ENV QUARKUS_OIDC_AUTH_SERVER_URL=https://security.lions.dev/realms/unionflow
+ENV QUARKUS_OIDC_CLIENT_ID=unionflow-server
+ENV KEYCLOAK_CLIENT_SECRET=changeme
+ENV QUARKUS_OIDC_TLS_VERIFICATION=required
+
+# Configuration CORS pour production
+ENV CORS_ORIGINS=https://unionflow.lions.dev,https://security.lions.dev
+ENV QUARKUS_HTTP_CORS_ORIGINS=${CORS_ORIGINS}
+
+# Configuration Wave Money (optionnel)
+ENV WAVE_API_KEY=
+ENV WAVE_API_SECRET=
+ENV WAVE_API_BASE_URL=https://api.wave.com/v1
+ENV WAVE_ENVIRONMENT=production
+ENV WAVE_WEBHOOK_SECRET=
+
+# Installer curl pour les health checks
+USER root
+RUN microdnf install curl -y && microdnf clean all
+RUN mkdir -p /app/logs && chown -R 185:185 /app/logs
+USER 185
+
+# Copier l'application depuis le builder
+COPY --from=builder --chown=185 /app/target/quarkus-app/lib/ /deployments/lib/
+COPY --from=builder --chown=185 /app/target/quarkus-app/*.jar /deployments/
+COPY --from=builder --chown=185 /app/target/quarkus-app/app/ /deployments/app/
+COPY --from=builder --chown=185 /app/target/quarkus-app/quarkus/ /deployments/quarkus/
+
+# Exposer le port
+EXPOSE 8085
+
+# Variables JVM optimisées pour production avec sécurité
+ENV JAVA_OPTS="-Xmx1g -Xms512m \
+    -XX:+UseG1GC \
+    -XX:MaxGCPauseMillis=200 \
+    -XX:+UseStringDeduplication \
+    -XX:+ParallelRefProcEnabled \
+    -XX:+HeapDumpOnOutOfMemoryError \
+    -XX:HeapDumpPath=/app/logs/heapdump.hprof \
+    -Djava.security.egd=file:/dev/./urandom \
+    -Djava.awt.headless=true \
+    -Dfile.encoding=UTF-8 \
+    -Djava.util.logging.manager=org.jboss.logmanager.LogManager \
+    -Dquarkus.profile=${QUARKUS_PROFILE}"
+
+# Point d'entrée avec profil production
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /deployments/quarkus-run.jar"]
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:8085/q/health/ready || exit 1
+