feat: security overhaul (proxy ssrf fix, streaming sanitization, docker optimization)

Dockerfile

@@ -1,7 +1,7 @@
 # ============================================
 # Stage 1: Build Flutter Web Application
 # ============================================
-FROM ghcr.io/cirruslabs/flutter:stable AS builder
+FROM ghcr.io/cirruslabs/flutter:stable AS web-builder
 
 USER root
 
@@ -17,61 +17,89 @@ ENV DART_VM_OPTIONS="--old_gen_heap_size=4096"
 RUN flutter config --enable-web
 
 # Copy dependency files first for better caching
-# Note: pubspec.lock will be generated by flutter pub get if missing
-# Cache buster - INCREMENT THIS VALUE TO FORCE REBUILD ON DEPLOY
-ARG CACHEBUST=2025-12-13-v7
+ARG CACHEBUST=2025-12-13-v8
 COPY pubspec.yaml ./
 
-# Get dependencies (generates pubspec.lock automatically)
+# Get dependencies
 RUN flutter pub get
 
 # Copy source code
 COPY . .
 
-# Re-run pub get after copying source to ensure lockfile consistency
+# Re-run pub get
 RUN flutter pub get
 
-# Generate code (for Riverpod and Hive)
+# Generate code
 RUN dart run build_runner build --delete-conflicting-outputs
 
-# Clean build environment to avoid conflicts
+# Clean build environment
 RUN flutter clean
 
-# Build web application (CanvasKit renderer is now default)
-# Added --no-tree-shake-icons to prevent potential font issues in some environments
+# Build web application
 RUN flutter build web --release --base-href="/" --no-wasm-dry-run --no-tree-shake-icons --verbose
 
 # ============================================
-# Stage 2: Serve with custom Dart server (with API proxy)
+# Stage 2: Compile Configurable Server (Native)
 # ============================================
-FROM dart:stable
+FROM dart:stable AS server-builder
 
 WORKDIR /app
 
-# Install SQLite3 library for FFI and FFmpeg for IPTV stream transcoding
-RUN apt-get update && apt-get install -y sqlite3 libsqlite3-dev ffmpeg && rm -rf /var/lib/apt/lists/*
-
-# Create directory for HLS stream output
-RUN mkdir -p /tmp/streams && chmod 777 /tmp/streams
-
-# Copy pubspec.yaml (required for dependencies)
 COPY pubspec.yaml ./
-
-# Copy lib directory (required for shared models)
+COPY bin/ ./bin/
 COPY lib/ ./lib/
 
-# Copy bin directory
-COPY bin/ ./bin/
-
 # Get dependencies
-RUN dart pub get --directory=bin
+RUN dart pub get
 
-# Copy built web application from builder stage
-COPY --from=builder /app/build/web /app/web
+# Compile server to native executable
+# This drastically reduces startup time and memory footprint (vs JIT)
+RUN dart compile exe bin/server.dart -o bin/server
 
-# Expose port (internal only, not mapped to host)
+# ============================================
+# Stage 3: Production Runtime
+# ============================================
+FROM debian:stable-slim
+
+# Install runtime dependencies
+# - ffmpeg: For transcoding
+# - ca-certificates: For HTTPS requests
+# - sqlite3: For database
+# - libsqlite3-0: Shared library for sqlite
+# - curl: For healthchecks (optional but good practice)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ffmpeg \
+    ca-certificates \
+    sqlite3 \
+    libsqlite3-0 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user for security
+RUN groupadd -r xtremuser && useradd -r -g xtremuser -G audio,video xtremuser
+
+WORKDIR /app
+
+# Create necessary data directories with correct permissions
+RUN mkdir -p /app/data /app/web /tmp/xtremflow_streams \
+    && chown -R xtremuser:xtremuser /app /tmp/xtremflow_streams
+
+# Copy built artifacts
+COPY --from=web-builder /app/build/web /app/web
+COPY --from=server-builder /app/bin/server /app/server
+
+# Set permission for the executable
+RUN chmod +x /app/server
+
+# Switch to non-root user
+USER xtremuser
+
+# Expose port
 EXPOSE 8089
 
-# Serve web application with API proxy
-WORKDIR /app
-CMD ["dart", "run", "bin/server.dart", "--port", "8089", "--path", "/app/web"]
+# Healthcheck
+HEALTHCHECK --interval=30s --timeout=3s \
+  CMD curl -f http://localhost:8089/index.html || exit 1
+
+# Start server
+CMD ["/app/server", "--port", "8089", "--path", "/app/web"]