feat: unify on single repo-root compose file for dev and prod

backend/Dockerfile

@@ -1,4 +1,6 @@
-# Production image for the FastAPI backend.
+# Backend image for dev and prod (single image, full dependencies).
+# Dev specifics (APP_ENV=dev for autoreload, opencode, SSH keys) arrive via
+# devcontainer.json / setup.sh — never via this file.
 FROM python:3.12-slim
 
 ENV PYTHONUNBUFFERED=1 \
@@ -6,16 +8,24 @@ ENV PYTHONUNBUFFERED=1 \
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
-WORKDIR /srv/backend
-COPY pyproject.toml alembic.ini ./
+# Foundational, inert in prod: non-root user for the editor, sudo for setup,
+# openssh-client for the devcontainer post-start hook.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends sudo openssh-client \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd -m -s /bin/bash vscode \
+    && echo "vscode ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/vscode
+
+WORKDIR /srv/kirche-einfach/backend
+COPY pyproject.toml alembic.ini entrypoint.sh ./
 COPY app ./app
 COPY migrations ./migrations
 COPY scripts ./scripts
 # No lockfile is committed; dependencies resolve at build time.
-RUN uv sync --no-dev
+# Full groups (incl. dev): pytest and friends must work in dev with zero steps.
+RUN uv sync && chmod +x entrypoint.sh
 
 ENV FLOWS_WATCH_ENABLED=true
 EXPOSE 8000
 
-# Migrate on start, then serve (watcher reconciles backend/flows automatically).
-CMD ["sh", "-c", ".venv/bin/alembic upgrade head && exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000"]
+ENTRYPOINT ["./entrypoint.sh"]

backend/app/settings.py

@@ -27,7 +27,7 @@ class Settings(BaseSettings):
     lfx_api_key: str = ""
     llm_api_key: str = ""
     # Base URL flows use for callbacks into this API. Must be reachable
-    # FROM the LFX process (compose: http://app:8000).
+    # FROM the LFX process (compose: http://api:8000).
     callback_base_url: str = "http://localhost:8000"
 
 

backend/entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Backend entrypoint (dev + prod): migrate, then serve.
+# APP_ENV=dev (set via devcontainer.json containerEnv, attached container
+# only) enables autoreload. Anything else runs the plain production server.
+set -e
+
+cd /srv/kirche-einfach/backend
+
+.venv/bin/alembic upgrade head
+
+if [ "${APP_ENV:-prod}" = "dev" ]; then
+  exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload
+else
+  exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000
+fi