feat: Docker-Support (Compose + Dockerfiles)

- docker-compose.yml: db (timescaledb/pg17) + backend + frontend
- backend/Dockerfile: multi-stage (golang:1.24-alpine -> debian:bookworm-slim)
- frontend/Dockerfile: multi-stage (node:22-alpine -> nginx:alpine), Build-Args fuer VITE_*
- frontend/nginx.conf: SPA-Routing + Asset-Caching
- .env.example: BACKEND_HOST, DB_PASSWORD, JWT_SECRET, API_KEY
- backend/config/config.go: ENV-Var-Support vervollstaendigt (JWT_SECRET, API_KEY, DB_PORT, DB_USER, DB_NAME)
- backend/config.yaml.example: ENV-Var Kommentare ergaenzt
- README: Docker-Quickstart als empfohlener Einstieg (3 Befehle)
- .gitignore: .env zur ignore-Liste hinzugefuegt

backend/Dockerfile

@@ -0,0 +1,31 @@
+FROM golang:1.24-alpine AS builder
+
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o rmm-backend .
+
+# ---
+
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY --from=builder /build/rmm-backend .
+COPY config.yaml.example config.yaml.example
+
+RUN mkdir -p certs
+
+EXPOSE 8443
+
+# Umgebungsvariablen mit Standardwerten (koennen alle per ENV ueberschrieben werden)
+ENV RMM_LISTEN_ADDR=":8443" \
+    RMM_DB_HOST="db" \
+    RMM_DB_PORT="5432" \
+    RMM_DB_USER="rmm" \
+    RMM_DB_NAME="rmm"
+
+CMD ["./rmm-backend"]

backend/config.yaml.example

@@ -1,8 +1,23 @@
 # RMM Backend Konfiguration
+# Kopiere diese Datei nach config.yaml und passe die Werte an.
+# Alle Werte koennen auch als Umgebungsvariablen gesetzt werden (Docker).
+
 listen_addr: ":8443"
 tls_cert: "certs/server.crt"
 tls_key: "certs/server.key"
-db_path: "rmm.db"
 
-api_keys:
-  - "YOUR_API_KEY"
+# Datenbank
+database:
+  host: "127.0.0.1"   # ENV: RMM_DB_HOST
+  port: 5432           # ENV: RMM_DB_PORT
+  user: "rmm"          # ENV: RMM_DB_USER
+  password: ""         # ENV: RMM_DB_PASSWORD
+  dbname: "rmm"        # ENV: RMM_DB_NAME
+  sslmode: "disable"
+
+# Sicherheit — zufaellige Strings waehlen, nie die Beispielwerte verwenden!
+jwt_secret: "ZUFAELLIGER_STRING_MIN_32_ZEICHEN"   # ENV: RMM_JWT_SECRET
+
+# API-Keys fuer Agent und Frontend-Zugriff
+api_keys:             # ENV: RMM_API_KEY (wird zusaetzlich angehaengt)
+  - "SELBST_GEWAEHLTER_API_KEY"

backend/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"fmt"
 	"os"
 
 	"github.com/cynfo/rmm-backend/db"
@@ -41,7 +42,7 @@ func Load(path string) (*Config, error) {
 		return nil, err
 	}
 
-	// Env overrides
+	// Env overrides — alle Werte koennen via ENV ueberschrieben werden (z.B. Docker)
 	if v := os.Getenv("RMM_LISTEN_ADDR"); v != "" {
 		cfg.ListenAddr = v
 	}
@@ -51,12 +52,32 @@ func Load(path string) (*Config, error) {
 	if v := os.Getenv("RMM_TLS_KEY"); v != "" {
 		cfg.TLSKey = v
 	}
+	if v := os.Getenv("RMM_JWT_SECRET"); v != "" {
+		cfg.JWTSecret = v
+	}
+	if v := os.Getenv("RMM_API_KEY"); v != "" {
+		cfg.APIKeys = append(cfg.APIKeys, v)
+	}
 	if v := os.Getenv("RMM_DB_HOST"); v != "" {
 		cfg.Database.Host = v
 	}
+	if v := os.Getenv("RMM_DB_PORT"); v != "" {
+		if port := 0; len(v) > 0 {
+			fmt.Sscanf(v, "%d", &port)
+			if port > 0 {
+				cfg.Database.Port = port
+			}
+		}
+	}
+	if v := os.Getenv("RMM_DB_USER"); v != "" {
+		cfg.Database.User = v
+	}
 	if v := os.Getenv("RMM_DB_PASSWORD"); v != "" {
 		cfg.Database.Password = v
 	}
+	if v := os.Getenv("RMM_DB_NAME"); v != "" {
+		cfg.Database.DBName = v
+	}
 
 	return cfg, nil
 }