feat(nix): add Docker container build to flake

- Add brewlog-container package using dockerTools.buildImage
- Include cacert for TLS with /etc/ssl/certs and /bin linked
- Run as uid/gid 1000 with database at /data/brewlog.db
- Document Docker usage in README

README.md

@@ -102,6 +102,35 @@ directory is loaded automatically via [dotenvy](https://crates.io/crates/dotenvy
 
 SQLite is used for storage. Migrations run automatically on server startup.
 
+## Running with Docker
+
+The Nix flake includes a Docker image built with `dockerTools`:
+
+```bash
+nix build .#brewlog-container
+docker load < result
+```
+
+Create a `docker.env` file:
+
+```env
+BREWLOG_ADMIN_USERNAME=admin
+BREWLOG_ADMIN_PASSWORD=password
+BREWLOG_OPENROUTER_API_KEY=sk-or-...
+BREWLOG_OPENROUTER_MODEL=google/gemini-3-flash-preview
+BREWLOG_FOURSQUARE_API_KEY=fsq3...
+BREWLOG_RP_ID=localhost
+BREWLOG_BIND_ADDRESS=0.0.0.0:3000
+BREWLOG_RP_ORIGIN=http://localhost:4000
+```
+
+```bash
+mkdir data
+docker run --rm -p 4000:3000 --env-file docker.env -v $PWD/data:/data brewlog:0.1.0
+```
+
+The database is stored at `/data/brewlog.db` inside the container — mount a host directory to `/data` to persist it.
+
 ## Contributing
 
 ```bash

flake.nix

@@ -50,7 +50,10 @@
               src = lib.cleanSource ./.;
               cargoLock.lockFile = ./Cargo.lock;
 
-              nativeBuildInputs = [ pkgs.pkg-config pkgs.tailwindcss_4 ];
+              nativeBuildInputs = [
+                pkgs.pkg-config
+                pkgs.tailwindcss_4
+              ];
               buildInputs = [ pkgs.openssl ];
 
               preBuild = ''
@@ -66,6 +69,32 @@
                 maintainers = with lib.maintainers; [ jnsgruk ];
               };
             };
+
+            brewlog-container = pkgs.dockerTools.buildImage {
+              name = "brewlog";
+              tag = version;
+              created = "now";
+              copyToRoot = pkgs.buildEnv {
+                name = "image-root";
+                paths = [
+                  self.packages.${system}.brewlog
+                  pkgs.cacert
+                ];
+                pathsToLink = [
+                  "/bin"
+                  "/etc/ssl/certs"
+                ];
+              };
+              config = {
+                Entrypoint = [
+                  "${lib.getExe self.packages.${system}.brewlog}"
+                  "serve"
+                  "--database-url"
+                  "sqlite:///data/brewlog.db"
+                ];
+                User = "1000:1000";
+              };
+            };
           };
 
           devShells = {
@@ -75,8 +104,9 @@
               NIX_CONFIG = "experimental-features = nix-command flakes";
               RUST_SRC_PATH = "${rust}/lib/rustlib/src/rust/library";
 
-              buildInputs =
-                [ rust ]
+              buildInputs = [
+                rust
+              ]
               ++ (with pkgs; [
                 cargo-watch
                 nil