feat: add health endpoint, release config, and Dockerfile for k8s deployment

- GET /api/health — JSON probe endpoint (no auth)
- CentralcloudMy.Release — Ecto migrate/rollback for init container
- rel/overlays/bin/{server,migrate} scripts for the OTP release
- mix.exs releases: centralcloud_my targeting core + my apps
- Dockerfile: umbrella-aware multi-stage build on hexpm/elixir:1.19.5-erlang-28

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dockerfile

@@ -0,0 +1,52 @@
+FROM hexpm/elixir:1.19.5-erlang-28.3.1-debian-trixie-20260202-slim AS build
+
+RUN apt-get update -y && apt-get install -y --no-install-recommends \
+    build-essential git npm ca-certificates \
+  && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+ENV MIX_ENV=prod
+
+RUN mix local.hex --force && mix local.rebar --force
+
+# Umbrella root deps
+COPY mix.exs mix.lock ./
+COPY apps/centralcloud_core/mix.exs ./apps/centralcloud_core/
+COPY apps/centralcloud_my/mix.exs ./apps/centralcloud_my/
+COPY apps/centralcloud_ops/mix.exs ./apps/centralcloud_ops/
+
+RUN mix deps.get --only prod && mix deps.compile
+
+COPY config ./config
+COPY apps/centralcloud_core ./apps/centralcloud_core
+COPY apps/centralcloud_my ./apps/centralcloud_my
+
+RUN mix compile
+
+# Build release for centralcloud_my only
+COPY rel ./rel
+RUN mix release centralcloud_my
+
+FROM debian:trixie-slim AS app
+
+RUN apt-get update -y && apt-get install -y --no-install-recommends \
+    libstdc++6 openssl libncurses6 locales ca-certificates \
+  && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+RUN useradd --create-home --shell /bin/sh app
+
+WORKDIR /app
+RUN chown app:app /app
+
+USER app
+
+COPY --from=build --chown=app:app /app/_build/prod/rel/centralcloud_my ./
+
+# Convenience symlink for migrate init container
+RUN ln -s /app/bin/centralcloud_my /app/bin/migrate || true
+
+ENV HOME=/app
+ENV PHX_SERVER=true
+
+CMD ["/app/bin/server"]

apps/centralcloud_my/lib/centralcloud_my/controllers/health_controller.ex

@@ -0,0 +1,7 @@
+defmodule CentralcloudMy.HealthController do
+  use Phoenix.Controller, formats: [:json]
+
+  def check(conn, _params) do
+    json(conn, %{status: "ok"})
+  end
+end

apps/centralcloud_my/lib/centralcloud_my/release.ex

@@ -0,0 +1,22 @@
+defmodule CentralcloudMy.Release do
+  @app :centralcloud_my
+
+  def migrate do
+    load_app()
+    for repo <- repos() do
+      {:ok, _, _} = Ecto.Migrator.with_repo(repo, &Ecto.Migrator.run(&1, :up, all: true))
+    end
+  end
+
+  def rollback(repo, version) do
+    load_app()
+    {:ok, _, _} = Ecto.Migrator.with_repo(repo, &Ecto.Migrator.run(&1, :down, to: version))
+  end
+
+  defp repos, do: Application.fetch_env!(@app, :ecto_repos)
+
+  defp load_app do
+    Application.ensure_all_started(:ssl)
+    Application.ensure_loaded(@app)
+  end
+end

apps/centralcloud_my/lib/centralcloud_my/router.ex

@@ -5,6 +5,10 @@ defmodule CentralcloudMy.Router do
   @session_opts [store: :cookie, key: "_centralcloud_my_session", signing_salt: "my_salt_2026"]
   def session_opts, do: @session_opts
 
+  pipeline :api do
+    plug :accepts, ["json"]
+  end
+
   pipeline :browser do
     plug :accepts, ["html"]
     plug :fetch_session
@@ -18,6 +22,12 @@ defmodule CentralcloudMy.Router do
     plug CentralcloudMy.Plugs.RequireAuth
   end
 
+  # Health check — no auth, no CSRF
+  scope "/api", CentralcloudMy do
+    pipe_through :api
+    get "/health", HealthController, :check
+  end
+
   # Public routes
   scope "/", CentralcloudMy do
     pipe_through :browser

mix.exs

@@ -6,7 +6,14 @@ defmodule Centralcloud.MixProject do
       apps_path: "apps",
       version: "0.1.0",
       start_permanent: Mix.env() == :prod,
-      deps: deps()
+      deps: deps(),
+      releases: [
+        centralcloud_my: [
+          applications: [centralcloud_core: :permanent, centralcloud_my: :permanent],
+          overlays: "rel/overlays",
+          steps: [:assemble, :tar]
+        ]
+      ]
     ]
   end
 

rel/overlays/bin/migrate

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+cd -P -- "$(dirname -- "$0")"
+exec ./centralcloud_my eval CentralcloudMy.Release.migrate

rel/overlays/bin/server

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+cd -P -- "$(dirname -- "$0")"
+PHX_SERVER=true exec ./centralcloud_my start