**Refactor Docker and Compose for enhanced compatibility and efficiency**

- Restructured `Dockerfile` to include a dedicated frontend build stage and improved runtime configurations.
- Added new health checks and adjusted environment variables for better container management.
- Updated cron job configurations to leverage `/opt/venv` and align with new paths.
- Refined `docker-compose` files for multi-service setups, including better volume and environment variable handling.
- Migrated `cbwebreader-cron` service setup and improved restart policies across the board.
- Enhanced `.gitea` CI workflow to use updated tools (`uv`), streamline buildx processes, and ensure proper version extraction from metadata.

Dockerfile

@@ -1,36 +1,57 @@
-FROM python:3.14-slim-trixie
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
-ENV PYTHONFAULTHANDLER=1 \
-    PYTHONHASHSEED=random \
-    PYTHONUNBUFFERED=1 \
-    PYTHONDONTWRITEBYTECODE=1 \
-    PIP_DEFAULT_TIMEOUT=100 \
-    PIP_DISABLE_PIP_VERSION_CHECK=1 \
-    PIP_NO_CACHE_DIR=1
-ENV PATH="${PATH}:/root/.local/bin"
-
-RUN mkdir /src
-RUN mkdir /static
+# ---------------------------------------------------------------------------
+# Frontend build stage
+# ---------------------------------------------------------------------------
+FROM node:22-slim AS frontend
 
 WORKDIR /src
 
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
 
+COPY frontend/ ./
+RUN npm run build
 
-RUN  echo "deb http://ftp.uk.debian.org/debian trixie non-free non-free-firmware" > /etc/apt/sources.list.d/non-free.list
+# ---------------------------------------------------------------------------
+# Runtime stage
+# ---------------------------------------------------------------------------
+FROM python:3.14-slim-trixie
 
-RUN apt update \
-    && apt install -y npm cron unrar libmariadb-dev libpq-dev pkg-config swig curl
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
-COPY . /src/
+ENV PYTHONFAULTHANDLER=1 \
+    PYTHONHASHSEED=random \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
 
+ENV UV_PROJECT_ENVIRONMENT=/opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# unrar lives in the non-free component; resolve the codename from the base image
+# instead of hardcoding it.
+RUN . /etc/os-release \
+    && echo "deb http://deb.debian.org/debian ${VERSION_CODENAME} non-free non-free-firmware" \
+        > /etc/apt/sources.list.d/non-free.list \
+    && apt update \
+    && apt install -y --no-install-recommends cron unrar libmariadb-dev pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+
+# Lockfiles first so dependency installation is cached independently of the source.
+COPY pyproject.toml uv.lock ./
 RUN uv sync --frozen --no-dev
 
-RUN cd frontend \
-    && npm install \
-    && npm run build \
-    && rm -r node_modules
+COPY . /src/
+COPY --from=frontend /src/dist /src/frontend/dist
+COPY --from=frontend /src/webpack-stats.json /src/frontend/webpack-stats.json
 
+RUN mkdir -p /static /media
 
 RUN cat /src/cbreader/crontab >> /etc/crontab
 
 EXPOSE 8000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/')" || exit 1
+
+CMD ["sh", "entrypoint.sh"]