Development

.dockerignore

@@ -0,0 +1,25 @@
+# Build context for client images is the repo root (see src/apphost/AppHost.cs
+# AddDockerfile calls). Keep the context lean — only src/ sources and
+# .devcontainer/certs are COPYed by src/Dockerfile-client-universal.
+
+# Version control / tooling
+.git/
+.github/
+.vscode/
+.idea/
+
+# Node / frontend
+**/node_modules/
+**/dist/
+
+# .NET build output
+**/bin/
+**/obj/
+**/_db/
+
+# Docs and non-build assets
+docs/
+site/
+experimental/
+src/Ghosts.Api/wwwroot/lib/fontawesome/svgs/
+src/Ghosts.Api/wwwroot/flags/

.gitignore

@@ -343,8 +343,6 @@ output/
 .claude/settings.local.json
 src/apphost/n8n_data/*
 src/Ghosts.Api/config/AttackData/enterprise-attack.json
-src/certs/*
-!src/certs/readme.md
 site/*
 site/
 .agents/*

src/Dockerfile-client-universal

@@ -2,11 +2,17 @@
 
 FROM mcr.microsoft.com/dotnet/sdk:10.0.101 AS dev
 
-COPY certs/*.crt /usr/local/share/ca-certificates/
-RUN update-ca-certificates
+# Custom Cert Support — single source of truth in .devcontainer/certs.
+# The dir always exists (readme.md is committed); .crt files are gitignored,
+# so tolerate an empty set and only update the trust store when certs are present.
+COPY .devcontainer/certs /usr/local/share/ca-certificates/custom/
+RUN find /usr/local/share/ca-certificates/custom -type f ! -name '*.crt' -delete \
+    && if find /usr/local/share/ca-certificates/custom -type f -name '*.crt' -print -quit | grep -q .; then \
+    update-ca-certificates; \
+    fi
 
-COPY Ghosts.Client.Universal/. /app/Ghosts.Client.Universal
-COPY Ghosts.Domain/. /app/Ghosts.Domain
+COPY src/Ghosts.Client.Universal/. /app/Ghosts.Client.Universal
+COPY src/Ghosts.Domain/. /app/Ghosts.Domain
 
 WORKDIR /app/Ghosts.Client.Universal
 RUN dotnet publish -c Release -o /app/dist

src/apphost/AppHost.cs

@@ -119,21 +119,21 @@
     .WaitFor(postgres);
 
 // GHOSTS Universal Clients (built from source, demo/testing)
-var client1 = builder.AddDockerfile("ghosts-client-1", "../", "Dockerfile-client-universal")
+var client1 = builder.AddDockerfile("ghosts-client-1", "../../", "src/Dockerfile-client-universal")
     .WithContainerName("ghosts-client-1")
     .WithEnvironment("BASE_URL", "http://host.docker.internal:5000/api")
     .WithBindMount("../../configuration/clients/client-1/config", "/app/config", isReadOnly: false)
     .WithLifetime(ContainerLifetime.Persistent)
     .WaitFor(api);
 
-var client2 = builder.AddDockerfile("ghosts-client-2", "../", "Dockerfile-client-universal")
+var client2 = builder.AddDockerfile("ghosts-client-2", "../../", "src/Dockerfile-client-universal")
     .WithContainerName("ghosts-client-2")
     .WithEnvironment("BASE_URL", "http://host.docker.internal:5000/api")
     .WithBindMount("../../configuration/clients/client-2/config", "/app/config", isReadOnly: false)
     .WithLifetime(ContainerLifetime.Persistent)
     .WaitFor(api);
 
-var client3 = builder.AddDockerfile("ghosts-client-3", "../", "Dockerfile-client-universal")
+var client3 = builder.AddDockerfile("ghosts-client-3", "../../", "src/Dockerfile-client-universal")
     .WithContainerName("ghosts-client-3")
     .WithEnvironment("BASE_URL", "http://host.docker.internal:5000/api")
     .WithBindMount("../../configuration/clients/client-3/config", "/app/config", isReadOnly: false)