3 Commits

Include renames

Author	SHA1	Message	Date
Latte	5d24ec3687	hello :)	2026-07-05 18:30:10 +02:00
Latte	ef1567b071	chore(deploy): drop Traefik labels, document Pangolin as the proxy ... The compose service already joins the external `proxy` network and exposes :8080; the reverse proxy owns TLS and routing. Remove the Traefik router labels (and the now-unused FAMILIAR_DOMAIN / TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers the service on the shared network — as the proxy instead. nginx/Caddy guidance is unchanged.	2026-07-05 13:38:51 +02:00
Latte	39ce8005c0	feat(docker): image, compose, and env for remote-HTTP deployment ... - docker/Dockerfile: multi-stage uv wheel build; runtime runs `familiar serve` as a non-root user (uid 1000) on port 8080, /data volume for the encrypted token store, and a HEALTHCHECK against /healthz. No token is baked in — serve refuses to start without FAMILIAR_HTTP_TOKEN, so it's supplied at run time. - docker-compose.yml: joins an external `proxy` network (Traefik labels for TLS, nginx/Caddy documented as alternatives), read-only rootfs, tmpfs /tmp, no-new-privileges, cap_drop ALL, non-root, /healthz healthcheck. Pulls the published FAMILIAR_IMAGE with a local build as fallback; writes default off. - .env.example: every FAMILIAR_* knob incl. the bearer token, auth mode, the OAuth resource-server settings, and the insecure-bind escape hatch. - .dockerignore: keep local state (data/, *.enc, key) and dev files out.	2026-07-04 19:26:17 +02:00