add docker setup

docker-deploy/Dockerfile

@@ -0,0 +1,50 @@
+# syntax=docker/dockerfile:1
+#
+# Standalone mailgoserver image — SMTP + IMAP + admin dashboard + webmail, no rspamd.
+# The built-in heuristic spam score (internal/mailstore/spam.go) always runs regardless;
+# this is for anyone who doesn't want rspamd's extra dependency. See Dockerfile.rspamd
+# for the bundled variant.
+#
+# Build from the repo root:
+#   docker build -f docker-deploy/Dockerfile -t mailgoserver .
+
+FROM golang:1.26-bookworm AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+# modernc.org/sqlite and every other dependency here are pure Go (no cgo), so a fully
+# static binary is just CGO_ENABLED=0 — no libc/gcc needed in the runtime image.
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/mailgoserver .
+
+FROM debian:bookworm-slim
+# ca-certificates: outbound direct-to-MX delivery verifies remote STARTTLS certs.
+# tzdata: [Server] time_zone (e.g. "Europe/London") needs the real IANA zone
+# database — time.LoadLocation silently falls back to UTC without it.
+# curl: used by the HEALTHCHECK below.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates tzdata curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /out/mailgoserver /usr/local/bin/mailgoserver
+
+# Everything persistent — the auto-generated settings.ini, the SQLite DB, encrypted
+# mailbox storage, DKIM/mailstore master keys, TLS certs, the app secret — lives under
+# whatever directory the process is started from (see config.Load / main.go's
+# os.Getwd()). One volume here covers all of it; no need to enumerate subpaths.
+WORKDIR /app/data
+VOLUME ["/app/data"]
+
+# Defaults from internal/config/config.go's generated settings.ini: SMTP 25, direct-TLS
+# SMTP 465, IMAP 143, direct-TLS IMAP 993 (the actual standard ports — binding them
+# needs no setcap/capability here since this container runs as root), admin/webmail
+# HTTP 5000, HTTPS 5001 (deliberately non-privileged; put a reverse proxy or the host's
+# own 80/443 in front if you want those too).
+EXPOSE 25 465 143 993 5000 5001
+
+# --host 0.0.0.0 is required: the binary's own default is 127.0.0.1, which would only
+# be reachable from inside this container, never through a published port.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -fs http://127.0.0.1:5000/health || exit 1
+
+ENTRYPOINT ["mailgoserver", "--host", "0.0.0.0"]