Move backend Dockerfile to repo root for git access

Place the backend Dockerfile at repo root as Dockerfile.backend so
the build context includes .git, giving git describe access for
version stamping. Fix .gitignore pattern to anchor /netwatch-server
so it does not exclude cmd/netwatch-server/. Remove .git from
.dockerignore. Update CI workflow and backend Makefile docker target.

.gitea/workflows/check.yml

@@ -7,4 +7,4 @@ jobs:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
             - run: docker build .
-            - run: docker build backend/
+            - run: docker build -f Dockerfile.backend .

Dockerfile.backend

@@ -6,10 +6,11 @@ RUN apk add --no-cache git make gcc musl-dev
 # golangci-lint v2.7.2 (2026-02-27)
 RUN CGO_ENABLED=0 go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@9f61b0f53f80672872fced07b6874397c3ed197b
 
-WORKDIR /src
-COPY go.mod go.sum ./
+WORKDIR /repo/backend
+COPY backend/go.mod backend/go.sum ./
 RUN go mod download
-COPY . .
+COPY .git /repo/.git
+COPY backend/ .
 
 RUN make check
 RUN make build
@@ -18,8 +19,7 @@ RUN make build
 FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 
 RUN apk add --no-cache ca-certificates
-COPY --from=builder /src/netwatch-server /usr/local/bin/netwatch-server
-COPY --from=builder /src /src
+COPY --from=builder /repo/backend/netwatch-server /usr/local/bin/netwatch-server
 
 EXPOSE 8080
 ENTRYPOINT ["netwatch-server"]

backend/.dockerignore

@@ -1,3 +1,2 @@
-.git
 node_modules
 .DS_Store

backend/.gitignore

@@ -1,4 +1,4 @@
-netwatch-server
+/netwatch-server
 *.log
 *.out
 *.test

backend/Makefile

@@ -37,7 +37,7 @@ fmt-check:
 check: test lint fmt-check
 
 docker:
-	timeout 300 docker build -t netwatch-server .
+	timeout 300 docker build -t netwatch-server -f ../Dockerfile.backend ..
 
 hooks:
 	@printf '#!/bin/sh\ncd backend && make check\n' > \

backend/cmd/netwatch-server/main.go

@@ -0,0 +1,42 @@
+// Package main is the entry point for netwatch-server.
+package main
+
+import (
+	"sneak.berlin/go/netwatch/internal/config"
+	"sneak.berlin/go/netwatch/internal/globals"
+	"sneak.berlin/go/netwatch/internal/handlers"
+	"sneak.berlin/go/netwatch/internal/healthcheck"
+	"sneak.berlin/go/netwatch/internal/logger"
+	"sneak.berlin/go/netwatch/internal/middleware"
+	"sneak.berlin/go/netwatch/internal/reportbuf"
+	"sneak.berlin/go/netwatch/internal/server"
+
+	"go.uber.org/fx"
+)
+
+//nolint:gochecknoglobals // set via ldflags at build time
+var (
+	Appname   = "netwatch-server"
+	Version   string
+	Buildarch string
+)
+
+func main() {
+	globals.Appname = Appname
+	globals.Version = Version
+	globals.Buildarch = Buildarch
+
+	fx.New(
+		fx.Provide(
+			config.New,
+			globals.New,
+			handlers.New,
+			healthcheck.New,
+			logger.New,
+			middleware.New,
+			reportbuf.New,
+			server.New,
+		),
+		fx.Invoke(func(*server.Server) {}),
+	).Run()
+}