feat: Phase 1 – Plattform-Grundgerüst (Docker, NestJS, React, Auth)

Dockerfile

@@ -0,0 +1,57 @@
+# syntax=docker/dockerfile:1
+
+# =============================================================
+# MPM – Management-Container
+# Ein einzelner Container, der als unprivilegierter Benutzer
+# folgende Prozesse verwaltet (via Supervisor):
+#   - Nginx (Reverse Proxy, Port 8080)
+#   - NestJS Management-Backend (127.0.0.1:3000)
+# Ab Phase 3 laufen hier zusätzlich die Modul-Prozesse.
+# Kein Docker-in-Docker, kein Docker-Socket.
+# =============================================================
+
+# ---------- Frontend-Build ----------
+FROM node:24-slim AS frontend-build
+WORKDIR /build
+COPY apps/platform-frontend/package.json apps/platform-frontend/package-lock.json ./
+RUN npm ci
+COPY apps/platform-frontend/ ./
+RUN npm run build
+
+# ---------- Backend-Build ----------
+FROM node:24-slim AS backend-build
+WORKDIR /build
+COPY apps/platform-backend/package.json apps/platform-backend/package-lock.json ./
+RUN npm ci
+COPY apps/platform-backend/ ./
+RUN npm run build
+RUN npm prune --omit=dev
+
+# ---------- Laufzeit-Image ----------
+FROM node:24-slim AS runtime
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends nginx supervisor \
+ && rm -rf /var/lib/apt/lists/*
+
+# Unprivilegierter Benutzer für alle Prozesse im Container
+RUN groupadd --gid 1001 app \
+ && useradd --uid 1001 --gid 1001 --create-home --shell /usr/sbin/nologin app \
+ && mkdir -p /tmp/nginx/client_body /tmp/nginx/proxy /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi /var/log/supervisor \
+ && chown -R app:app /tmp/nginx /var/log/supervisor
+
+COPY docker/nginx/nginx.conf /etc/nginx/nginx.conf
+COPY docker/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
+
+COPY --from=backend-build --chown=app:app /build/dist /app/platform-backend/dist
+COPY --from=backend-build --chown=app:app /build/node_modules /app/platform-backend/node_modules
+COPY --from=backend-build --chown=app:app /build/package.json /app/platform-backend/package.json
+COPY --from=frontend-build --chown=app:app /build/dist /app/public
+
+USER app
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:8080/api/v1/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+
+CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisor/supervisord.conf"]