build: have Clever Cloud build the image from source (#55)

Previously `Dockerfile` was a passthrough that pulled a prebuilt image
from GHCR. The point was to dodge OOM kills on Clever's smaller
builders, but it had a deploy-time cost: Clever's docker layer cache
would hold onto the cached `FROM ghcr.io/...:latest` layer across
deploys, so config changes required an empty 'redeploy' commit AND a
cache bust to actually reach prod.

Move the real source build into `Dockerfile` and drop the
passthrough. Each git push now does a full rebar3 release on Clever
itself — slower, but every commit deploys what's in the commit.

The GHCR workflow still runs (now pointed at `Dockerfile`) so the
public image stays available for self-hosters; it's just no longer in
the deploy path.

Author: Taure

.github/workflows/docker-publish.yml

@@ -49,7 +49,7 @@ jobs:
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
-          file: Dockerfile.build
+          file: Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

Dockerfile

@@ -1,12 +1,30 @@
-#
-# Passthrough Dockerfile for Clever Cloud.
-#
-# The real image is built in GitHub Actions (see
-# .github/workflows/docker-publish.yml) and published to GHCR. Clever's
-# builder OOM-kills during rebar3 / erlfmt compilation on low-RAM nodes,
-# so we have it pull the prebuilt image instead of rebuilding from source.
-#
-# Everything (Erlang release, CMD, EXPOSE, PORT) comes baked in via the
-# source Dockerfile preserved at Dockerfile.build in this repo.
-#
-FROM ghcr.io/widgrensit/asobi_site:latest
+FROM erlang:28 AS builder
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+
+COPY rebar.config rebar.lock ./
+RUN rebar3 compile --deps_only
+
+COPY config ./config
+COPY src ./src
+COPY priv ./priv
+
+RUN rebar3 as prod release
+
+FROM debian:trixie-slim
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    libssl3 libncurses6 libstdc++6 && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY --from=builder /app/_build/prod/rel/asobi_site ./
+
+ENV PORT=8080
+EXPOSE 8080
+
+CMD ["bin/asobi_site", "foreground"]