docker: slim build by excluding .git and non-essential files

Replace the in-Dockerfile `git rev-parse HEAD` with a GIT_HASH build arg
passed from docker-compose (local) or github.sha (CI), defaulting to
"unknown" when unset.

Also exclude .github/, docs/, tests/, and *.md (except www/**/*.md).

.dockerignore

@@ -6,3 +6,13 @@ __pycache__
 *.ini
 .pytest_cache
 .env
+
+# Slim build context — .git/ alone can be 100s of MB
+.git
+.github/
+docs/
+tests/
+
+# Exclude markdown files but keep www/src/*.md (used by WebsiteDeployer)
+*.md
+!www/**/*.md

.github/workflows/docker-build.yaml

@@ -72,3 +72,5 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          build-args: |
+            GIT_HASH=${{ github.sha }}

docker-compose.yaml

@@ -12,6 +12,8 @@ services:
     build:
       context: ./
       dockerfile: docker/chatmail_relay.dockerfile
+      args:
+        GIT_HASH: ${GIT_HASH:-unknown}
     image: chatmail-relay:latest
     restart: unless-stopped
     container_name: chatmail

docker/chatmail_relay.dockerfile

@@ -62,8 +62,12 @@ RUN cp -a www/ /opt/chatmail-www/
 
 RUN rm -f /tmp/chatmail.ini
 
-# Record image version for upgrade detection at runtime
-RUN git rev-parse HEAD > /etc/chatmail-image-version 2>/dev/null || echo "unknown" > /etc/chatmail-image-version
+# Record image version for upgrade detection at runtime.
+# GIT_HASH is passed as a build arg (from docker-compose or CI) so that
+# .git/ can be excluded from the build context via .dockerignore.
+ARG GIT_HASH=unknown
+RUN echo "$GIT_HASH" > /etc/chatmail-image-version && \
+    echo "$GIT_HASH" > /etc/chatmail-version
 # --- End build-time install ---
 
 ENV CHATMAIL_INI=/etc/chatmail/chatmail.ini