build(docker): add Dockerfile for building a server image

.dockerignore

@@ -0,0 +1,8 @@
+target/
+dist/
+aw-webui/dist/
+aw-webui/node_modules/
+**/node_modules/
+.cov/
+coverage-html/
+.serena/

Dockerfile

@@ -0,0 +1,33 @@
+# Build stage: aw-webui (node) + aw-server (rust, with the webui embedded via rust-embed)
+FROM rust:1-bookworm AS builder
+
+RUN apt-get update -qq -y && \
+    apt-get install -qq -y --no-install-recommends \
+        build-essential pkg-config libssl-dev ca-certificates curl git make gnupg && \
+    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
+    apt-get install -qq -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app/aw-server-rust
+COPY . .
+
+# `make aw-server` builds the webui (aw-webui/dist) before cargo, so that
+# aw-server's build.rs can embed the assets into the binary.
+# We avoid the `build` target, which also builds aw-sync: that binary pulls in
+# openssl with the "vendored" feature (builds OpenSSL from source) and is not
+# used by this image.
+RUN make aw-server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update -qq -y && \
+    apt-get install -qq -y --no-install-recommends \
+        libssl3 && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /app/aw-server-rust/target/release/aw-server /usr/local/bin/aw-server-rust
+COPY --from=builder /app/aw-server-rust/aw-webui/dist /usr/local/share/aw-webui
+
+EXPOSE 5600
+
+CMD ["aw-server-rust"]

README.md

@@ -42,6 +42,41 @@ cargo run --bin aw-server
 
 *NOTE:* This will start aw-server-rust in testing mode (on port 5666 instead of port 5600).
 
+### Docker
+
+A multi-stage `Dockerfile` is included. It builds the web UI and the server, and
+produces a slim Debian-based image containing only the `aw-server` binary (the
+web UI assets are embedded into it at compile time).
+
+The `aw-webui` submodule must be initialized before building:
+
+```sh
+git submodule update --init --recursive
+docker build -t aw-server-rust:local .
+```
+
+Run it with:
+
+```sh
+docker run -d --name aw-server-rust \
+    -p 5600:5600 \
+    -v aw-server-rust-data:/root/.local/share/activitywatch \
+    aw-server-rust:local aw-server-rust --host 0.0.0.0
+```
+
+Notes:
+
+ - The server binds to `127.0.0.1` by default, which is unreachable from outside
+   the container. Pass `--host 0.0.0.0` (as above) to make it reachable.
+ - The database lives in `/root/.local/share/activitywatch/aw-server-rust`.
+   Mount a volume there to keep it across container recreations.
+ - The image only ships `aw-server`. The `aw-sync` binary is deliberately not
+   built, since on Linux it pulls in OpenSSL with the `vendored` feature and
+   compiles it from source.
+ - `docker build` produces an image for the architecture of the machine running
+   it. To target a different one, use
+   `docker buildx build --platform linux/amd64 ...`.
+
 ### Configuration
 
 The server reads its configuration from `~/.config/activitywatch/aw-server-rust/config.toml` (or `config-testing.toml` in testing mode).