Add a docker build step.

backend/Cargo.lock

@@ -289,6 +289,7 @@ dependencies = [
  "serde",
  "sqlx",
  "tokio",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -3490,6 +3491,20 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+dependencies = [
+ "bitflags 2.9.3",
+ "bytes",
+ "http 1.3.1",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"

backend/Cargo.toml

@@ -12,6 +12,7 @@ chrono = { version = "0.4.41", features = ["serde"] }
 serde = "1.0.219"
 sqlx = { version = "0.8.6", features = ["sqlite", "runtime-tokio", "uuid", "chrono"] }
 tokio = { version = "1.47.1", features = ["rt-multi-thread", "tracing"] }
+tower-http = { version = "0.6.0", features = ["cors"] }
 tracing = "0.1.41"
 tracing-subscriber = "0.3.19"
 uuid = { version = "1.18.0", features = ["serde", "v4"] }

backend/Dockerfile

@@ -0,0 +1,47 @@
+# Multi-stage Dockerfile for Rust backend
+FROM rust:1.90-alpine as builder
+
+# Install build dependencies
+RUN apk add --no-cache \
+    musl-dev \
+    pkgconfig \
+    openssl-dev \
+    clang
+
+# Set working directory
+WORKDIR /app
+
+# Copy Cargo files for dependency caching
+COPY Cargo.toml Cargo.lock ./
+
+# Create a dummy main.rs to build dependencies
+RUN mkdir src && echo "fn main() {}" > src/main.rs
+
+# Build dependencies (cached layer)
+RUN cargo build --release && rm -rf src/
+
+# Copy source code
+COPY src/ src/
+COPY migrations/ migrations/
+
+# Build the application
+RUN cargo build --release
+
+# Runtime stage
+FROM alpine:latest
+
+# Install runtime dependencies
+RUN apk add --no-cache ca-certificates curl
+
+# Copy the binary from builder stage
+COPY --from=builder /app/target/release/backend /usr/local/bin/app
+
+# Expose port
+EXPOSE 3000
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD curl -f http://localhost:3000/health || exit 1
+
+# Run the application
+CMD ["app"]

backend/src/main.rs

@@ -1,4 +1,5 @@
 use axum::{Router, routing::get};
+use tower_http::cors::{Any, CorsLayer};
 
 mod database;
 mod models;
@@ -13,13 +14,33 @@ async fn main() {
     let pool = database::create_pool(&binding)
         .await
         .expect("Failed to create database pool");
+    let cors = if std::env::var("RUST_ENV").unwrap_or_default() == "production" {
+        CorsLayer::new()
+            .allow_origin([
+                "https://tiramisu.one"
+                    .parse::<axum::http::HeaderValue>()
+                    .unwrap(),
+                "https://*.tiramisu.one"
+                    .parse::<axum::http::HeaderValue>()
+                    .unwrap(),
+            ])
+            .allow_methods(Any)
+            .allow_headers(Any)
+    } else {
+        CorsLayer::new()
+            .allow_origin(Any)
+            .allow_methods(Any)
+            .allow_headers(Any)
+    };
+
     let app = Router::new()
         .route("/health", get(health))
         .nest("/api/tasks", services::create_task_router())
+        .layer(cors)
         .with_state(pool);
 
     let port = std::env::var("PORT").unwrap_or("3000".to_string());
-    let addr = format!("127.0.0.1:{}", port);
+    let addr = format!("0.0.0.0:{}", port);
 
     let listener = tokio::net::TcpListener::bind(addr).await.unwrap();