feat: implement project bus MVP

deploy/.env.example

@@ -0,0 +1,4 @@
+PROJECT_BUS_BOOTSTRAP_TOKEN=replace-with-a-long-random-secret
+PROJECT_BUS_TOKENS_JSON={}
+PROJECT_BUS_ALLOWED_ORIGINS=https://chatgpt.com
+

deploy/Dockerfile

@@ -0,0 +1,23 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PROJECT_BUS_DATABASE=/data/project-bus.db \
+    PROJECT_BUS_MIGRATIONS=/app/migrations \
+    PROJECT_BUS_HOST=0.0.0.0 \
+    PROJECT_BUS_PORT=8080
+
+WORKDIR /app
+COPY pyproject.toml README.md LICENSE ./
+COPY src ./src
+COPY migrations ./migrations
+RUN pip install --no-cache-dir --no-deps . \
+    && mkdir -p /data \
+    && chown -R 65532:65532 /data
+
+USER 65532:65532
+EXPOSE 8080
+VOLUME ["/data"]
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
+ENTRYPOINT ["project-bus"]

deploy/compose.yaml

@@ -0,0 +1,25 @@
+services:
+  project-bus:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile
+    restart: unless-stopped
+    environment:
+      PROJECT_BUS_BOOTSTRAP_TOKEN: "${PROJECT_BUS_BOOTSTRAP_TOKEN:?set a strong bootstrap token}"
+      PROJECT_BUS_TOKENS_JSON: "${PROJECT_BUS_TOKENS_JSON:-}"
+      PROJECT_BUS_ALLOWED_ORIGINS: "${PROJECT_BUS_ALLOWED_ORIGINS:-}"
+    ports:
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - project-bus-data:/data
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,noexec,nosuid,nodev
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+volumes:
+  project-bus-data:
+