build(backend): one shared Dockerfile with cargo cache mounts, sequential compose build, stripped release binaries

All four services now share one builder stage (dependencies compile once per
deploy, not once per service). BuildKit cache mounts keep the cargo registry
and target/ between deploys: a one-line change rebuilds in ~16 s instead of
recompiling the whole dependency tree.

backend/Cargo.toml

@@ -11,3 +11,8 @@ members = [
 # Planned members, added when their own implementation plan starts
 # (see backend/STRUCTURE.md and TODO.md Фаза 10 / Подсистемы 1-3):
 #   "addons-registry"   — addon marketplace backend (Подсистема 3)
+
+# Smaller binaries and images; no effect on build time or behaviour.
+[profile.release]
+strip = true
+debug = false

backend/Dockerfile

@@ -0,0 +1,49 @@
+# One Dockerfile for every backend service. Build context must be backend/
+# (the workspace root). Pick a service with `target:` in docker-compose.
+#
+# Why one file: all four services share one `builder` stage, so the dependency
+# tree (aws-sdk, sqlx, tonic, ...) is compiled once per deploy instead of once
+# per service. The BuildKit cache mounts keep the cargo registry and target/
+# between deploys, so a source change recompiles only the crates that changed.
+
+FROM rust:1-trixie AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    protobuf-compiler pkg-config libssl-dev ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /build
+COPY Cargo.toml Cargo.lock ./
+COPY common ./common
+COPY accounts-service ./accounts-service
+COPY gateway ./gateway
+COPY configs-service ./configs-service
+COPY chat-service ./chat-service
+# target/ lives in a cache mount, so the binaries are copied out in the same RUN.
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    --mount=type=cache,target=/build/target \
+    cargo build --release --locked \
+        -p accounts-service -p gateway -p configs-service -p chat-service \
+    && mkdir /out \
+    && cp target/release/accounts-service target/release/gateway \
+          target/release/configs-service target/release/chat-service /out/
+
+FROM debian:trixie-slim AS runtime
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+
+FROM runtime AS accounts-service
+COPY --from=builder /out/accounts-service /usr/local/bin/accounts-service
+ENTRYPOINT ["/usr/local/bin/accounts-service"]
+
+FROM runtime AS gateway
+COPY --from=builder /out/gateway /usr/local/bin/gateway
+ENTRYPOINT ["/usr/local/bin/gateway"]
+
+FROM runtime AS configs-service
+COPY --from=builder /out/configs-service /usr/local/bin/configs-service
+ENTRYPOINT ["/usr/local/bin/configs-service"]
+
+FROM runtime AS chat-service
+COPY --from=builder /out/chat-service /usr/local/bin/chat-service
+ENTRYPOINT ["/usr/local/bin/chat-service"]

backend/accounts-service/Dockerfile

@@ -1,20 +0,0 @@
-# Build context must be backend/ (the workspace root).
-FROM rust:1-trixie AS builder
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    protobuf-compiler pkg-config libssl-dev ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-WORKDIR /build
-COPY Cargo.toml Cargo.lock ./
-COPY common ./common
-COPY accounts-service ./accounts-service
-COPY gateway ./gateway
-COPY configs-service ./configs-service
-COPY chat-service ./chat-service
-RUN cargo build --release -p accounts-service
-
-FROM debian:trixie-slim
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates libssl3 \
-    && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /build/target/release/accounts-service /usr/local/bin/accounts-service
-ENTRYPOINT ["/usr/local/bin/accounts-service"]

backend/chat-service/Dockerfile

@@ -1,20 +0,0 @@
-# Build context must be backend/ (the workspace root).
-FROM rust:1-trixie AS builder
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    protobuf-compiler pkg-config libssl-dev ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-WORKDIR /build
-COPY Cargo.toml Cargo.lock ./
-COPY common ./common
-COPY accounts-service ./accounts-service
-COPY gateway ./gateway
-COPY configs-service ./configs-service
-COPY chat-service ./chat-service
-RUN cargo build --release -p chat-service
-
-FROM debian:trixie-slim
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates libssl3 \
-    && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /build/target/release/chat-service /usr/local/bin/chat-service
-ENTRYPOINT ["/usr/local/bin/chat-service"]

backend/configs-service/Dockerfile

@@ -1,20 +0,0 @@
-# Build context must be backend/ (the workspace root).
-FROM rust:1-trixie AS builder
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    protobuf-compiler pkg-config libssl-dev ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-WORKDIR /build
-COPY Cargo.toml Cargo.lock ./
-COPY common ./common
-COPY accounts-service ./accounts-service
-COPY gateway ./gateway
-COPY configs-service ./configs-service
-COPY chat-service ./chat-service
-RUN cargo build --release -p configs-service
-
-FROM debian:trixie-slim
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates libssl3 \
-    && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /build/target/release/configs-service /usr/local/bin/configs-service
-ENTRYPOINT ["/usr/local/bin/configs-service"]

backend/deploy/deploy.sh

@@ -8,9 +8,15 @@ FRONTEND_ROOT=/var/www/visual.loki-code.dev/html
 cd "$REPO_DIR"
 git pull --ff-only
 
-echo "==> Building & (re)starting backend services"
+echo "==> Building backend images (one at a time: the first builds the shared Rust builder stage, the rest reuse it)"
 cd "$REPO_DIR/backend"
-docker compose -f docker-compose.prod.yml up -d --build
+COMPOSE_PARALLEL_LIMIT=1 docker compose -f docker-compose.prod.yml build
+
+echo "==> (Re)starting backend services"
+docker compose -f docker-compose.prod.yml up -d
+
+echo "==> Trimming the build cache (keeps the cargo/target cache mounts warm, caps disk use)"
+docker builder prune -f --keep-storage 8GB >/dev/null || true
 
 echo "==> Building frontend"
 cd "$REPO_DIR/frontend"

backend/docker-compose.prod.yml

@@ -62,7 +62,8 @@ services:
   accounts-service:
     build:
       context: .
-      dockerfile: accounts-service/Dockerfile
+      dockerfile: Dockerfile
+      target: accounts-service
     restart: unless-stopped
     depends_on:
       postgres:
@@ -94,7 +95,8 @@ services:
   configs-service:
     build:
       context: .
-      dockerfile: configs-service/Dockerfile
+      dockerfile: Dockerfile
+      target: configs-service
     restart: unless-stopped
     depends_on:
       postgres:
@@ -111,7 +113,8 @@ services:
   chat-service:
     build:
       context: .
-      dockerfile: chat-service/Dockerfile
+      dockerfile: Dockerfile
+      target: chat-service
     restart: unless-stopped
     env_file: .env
     environment:
@@ -121,7 +124,8 @@ services:
   gateway:
     build:
       context: .
-      dockerfile: gateway/Dockerfile
+      dockerfile: Dockerfile
+      target: gateway
     restart: unless-stopped
     depends_on:
       accounts-service:

backend/gateway/Dockerfile

@@ -1,20 +0,0 @@
-# Build context must be backend/ (the workspace root).
-FROM rust:1-trixie AS builder
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    protobuf-compiler pkg-config libssl-dev ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-WORKDIR /build
-COPY Cargo.toml Cargo.lock ./
-COPY common ./common
-COPY accounts-service ./accounts-service
-COPY gateway ./gateway
-COPY configs-service ./configs-service
-COPY chat-service ./chat-service
-RUN cargo build --release -p gateway
-
-FROM debian:trixie-slim
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates libssl3 \
-    && rm -rf /var/lib/apt/lists/*
-COPY --from=builder /build/target/release/gateway /usr/local/bin/gateway
-ENTRYPOINT ["/usr/local/bin/gateway"]