Complete refactor of environment configuration and Docker setup for development and production.

- Dev and prod both now run with the same exact docker configuration, except the .env file copied in.
- Removed the `.env` file and added a new `.env.dev` file for development settings, including database configuration and API keys.
- Introduced a `.envrc` file for automatic venv activation.
- Updated `deploy.sh` to utilize `uv` for running management commands and added a command for building Tailwind CSS.
- Created `docker-compose.yml` for local development with PostgreSQL, ensuring proper service dependencies.
- Deleted unnecessary files such as `docker-compose_db_only.yml` and `requirements.txt` to streamline the project structure.

Dockerfile

@@ -1,30 +1,131 @@
-FROM python:3.12.2-bookworm
+# syntax=docker/dockerfile:1.9
+FROM python3.13-slim-bookworm AS build
 
-# (we want to write bytecode as we have multiple workers, so omit PYTHONDONTWRITEBYTECODE)
+# The following does not work in Podman unless you build in Docker
+# compatibility mode: <https://github.com/containers/podman/issues/8477>
+# You can manually prepend every RUN script with `set -ex` too.
+SHELL ["sh", "-exc"]
+
+# Ensure apt-get doesn't open a menu on you.
+ENV DEBIAN_FRONTEND=noninteractive
+
+### Start build prep.
+### This should be a separate build container for better reuse.
+
+# RUN <<EOT
+# apt-get update -qy
+# apt-get install -qyy \
+#     -o APT::Install-Recommends=false \
+#     -o APT::Install-Suggests=false \
+#     nodejs npm
+# EOT
+
+COPY --from=ghcr.io/astral-sh/uv:0.7.2 /uv /usr/local/bin/uv
+
+# - Silence uv complaining about not being able to use hard links,
+# - tell uv to byte-compile packages for faster application startups,
+# - prevent uv from accidentally downloading isolated Python builds,
+# - pick a Python, and finally declare `/app` as the target for `uv sync`.
+ENV UV_LINK_MODE=copy \
+    UV_COMPILE_BYTECODE=1 \
+    UV_PYTHON_DOWNLOADS=never \
+    UV_PYTHON=python3.13 \
+    UV_PROJECT_ENVIRONMENT=/app
+
+### End build prep -- this is where your app Dockerfile should start.
+
+# Synchronize DEPENDENCIES without the application itself.
+# This layer is cached until uv.lock or pyproject.toml change, which are
+# only temporarily mounted into the build container since we don't need
+# them in the production one.
+# You can create `/app` using `uv venv` in a separate `RUN`
+# step to have it cached, but with uv it's so fast, it's not worth
+# it, so we let `uv sync` create it for us automagically.
+RUN --mount=type=cache,target=/root/.cache \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    uv sync \
+        --locked \
+        --no-dev \
+        --no-install-project
+
+# Now install the rest from `/src`: The APPLICATION w/o dependencies.
+# `/src` will NOT be copied into the runtime container.
+# LEAVE THIS OUT if your application is NOT a proper Python package.
+# COPY . /src
+# WORKDIR /src
+# RUN --mount=type=cache,target=/root/.cache \
+#     uv sync \
+#         --locked \
+#         --no-dev \
+#         --no-editable
+
+
+##########################################################################
+
+FROM python:3.13-slim-bookworm
+SHELL ["sh", "-exc"]
+
+ARG ENV_FILE=.env.production
+
+# Optional: add the application virtualenv to search path.
+ENV PATH=/app/bin:$PATH
+ENV PYTHONPATH=/code
 ENV PYTHONUNBUFFERED 1
 ENV HOME /code
 
-RUN mkdir -p /code
-WORKDIR /code
+# Don't run your app as root.
+RUN <<EOT
+groupadd -r app
+useradd -r -d /app -g app -N app
+EOT
 
-COPY requirements.txt /tmp/requirements.txt
-
-RUN set -ex && \
-    pip install --upgrade pip && \
-    pip install -r /tmp/requirements.txt && \
-    rm -rf /root/.cache/
-
-RUN apt-get update && apt-get install -y nodejs npm xvfb netcat-openbsd nano curl
+# Note how the runtime dependencies differ from build-time ones.
+# Notably, there is no uv either!
+RUN <<EOT
+apt-get update -qy
+apt-get install -qyy \
+    -o APT::Install-Recommends=false \
+    -o APT::Install-Suggests=false \
+    nodejs xvfb curl
 
 RUN playwright install-deps && playwright install
 
-COPY . /code/
+apt-get clean
+rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+EOT
+
+# COPY docker-entrypoint.sh /
+# ENTRYPOINT ["/docker-entrypoint.sh"]
+# See <https://hynek.me/articles/docker-signals/>.
+STOPSIGNAL SIGINT
+
+# Copy the pre-built `/app` directory to the runtime container
+# and change the ownership to user app and group app in one step.
+COPY --from=build --chown=app:app /app /app
+
+# If your application is NOT a proper Python package that got
+# pip-installed above, you need to copy your application into
+# the container HERE:
+COPY . /code
+
+USER app
+#WORKDIR /app # If python-packaged
+WORKDIR /code # If not python-packaged
+
+# Strictly optional, but I like it for introspection of what I've built
+# and run a smoke test that the application can, in fact, be imported.
+# RUN <<EOT
+# python -V
+# python -Im site
+# python -Ic 'import the_app'
+# EOT`
+
 RUN rm -f .env
-COPY .env.production .env
+COPY ${ENV_FILE} .env
 
 EXPOSE 8000
 
-HEALTHCHECK CMD curl --fail http://localhost:8000 || exit 1
+HEALTHCHECK CMD curl --fail http://localhost:8000/health/ || exit 1
 
-#CMD ["gunicorn", "--bind", ":8000", "django_project.wsgi", "--workers", "3", "--worker-class", "gevent", "--worker-connections", "1000", "--worker-tmp-dir", "/dev/shm", "--timeout", "90"]
-CMD ["granian", "--interface", "wsgi", "django_project.wsgi", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
+CMD ["granian", "--interface", "wsgi", "django_project.wsgi", "--host", "0.0.0.0", "--port", "8000", "--workers", "4"]