feat: backend service

backend/Dockerfile

@@ -0,0 +1,62 @@
+# syntax=docker/dockerfile:1.7
+
+# Build context is the workspace root (galaxy/), not the backend/
+# subdirectory, because the backend module pulls galaxy/{cronutil,error,
+# geoip,model,postgres,util} through the go.work replace directives.
+# Build with:
+#
+#     docker build -t galaxy/backend:integration -f backend/Dockerfile .
+
+FROM golang:1.26.2-alpine AS builder
+WORKDIR /src
+ENV CGO_ENABLED=0 GOFLAGS=-trimpath
+
+COPY pkg/cronutil/ ./pkg/cronutil/
+COPY pkg/error/    ./pkg/error/
+COPY pkg/geoip/    ./pkg/geoip/
+COPY pkg/model/    ./pkg/model/
+COPY pkg/postgres/ ./pkg/postgres/
+COPY pkg/util/     ./pkg/util/
+COPY backend/      ./backend/
+
+# Synthesise a minimal go.work tailored to the backend binary so the
+# repository-level workspace (which lists every module) does not need
+# to be copied into the build context.
+RUN <<'EOF' cat > go.work
+go 1.26.2
+
+use (
+	./backend
+	./pkg/cronutil
+	./pkg/error
+	./pkg/geoip
+	./pkg/model
+	./pkg/postgres
+	./pkg/util
+)
+
+replace (
+	galaxy/cronutil v0.0.0 => ./pkg/cronutil
+	galaxy/error v0.0.0    => ./pkg/error
+	galaxy/geoip v0.0.0    => ./pkg/geoip
+	galaxy/model v0.0.0    => ./pkg/model
+	galaxy/postgres v0.0.0 => ./pkg/postgres
+	galaxy/util v0.0.0     => ./pkg/util
+)
+EOF
+
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    go build -ldflags="-s -w" -o /out/backend ./backend/cmd/backend
+
+FROM gcr.io/distroless/static-debian12:nonroot AS runtime
+
+LABEL org.opencontainers.image.title="galaxy-backend"
+
+EXPOSE 8080
+EXPOSE 8081
+USER nonroot:nonroot
+
+COPY --from=builder /out/backend /usr/local/bin/backend
+
+ENTRYPOINT ["/usr/local/bin/backend"]