initial public relay build repo

Dockerfile

@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1
+
+# --- Build stage -----------------------------------------------------------
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+
+# Cache modules independently of source.
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+# CGO disabled → a fully static binary (boltdb is pure Go), so it runs on scratch.
+# The command lives in ./cmd/nostermd; internal/* holds the relay packages.
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/nostermd ./cmd/nostermd
+# Stage an empty data dir we can copy in with the correct nonroot ownership.
+RUN mkdir -p /out/data
+
+# --- Runtime stage ---------------------------------------------------------
+FROM gcr.io/distroless/static-debian12:nonroot AS runtime
+
+# Binary + a data dir pre-owned by the distroless nonroot uid (65532), so the
+# unprivileged process can write the boltdb file to the mounted volume.
+COPY --from=build --chown=65532:65532 /out/nostermd /nostermd
+COPY --from=build --chown=65532:65532 /out/data /data
+
+# Persisted event storage (mount a volume here in production).
+VOLUME ["/data"]
+ENV RELAY_DATA_DIR=/data \
+	RELAY_ADDR=:3334
+
+USER 65532:65532
+EXPOSE 3334
+ENTRYPOINT ["/nostermd"]