3 Commits

Include renames

Author	SHA1	Message	Date
Latte	6b9c550d10	docs: document using Gitea as the OAuth issuer ... familiar is issuer-agnostic (resource server only), so Gitea can back oauth mode with config alone: RS256 JWTs, JWKS at /login/oauth/keys, and OIDC discovery. Add a deployment.md section covering the env config, the aud=client-ID audience pitfall, and the no-DCR caveat; add a Gitea block to .env.example; and note in claude-web.md that Gitea can't back the claude.ai web connector (which requires DCR).	2026-07-12 17:52:26 +02:00
Latte	ef1567b071	chore(deploy): drop Traefik labels, document Pangolin as the proxy ... The compose service already joins the external `proxy` network and exposes :8080; the reverse proxy owns TLS and routing. Remove the Traefik router labels (and the now-unused FAMILIAR_DOMAIN / TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers the service on the shared network — as the proxy instead. nginx/Caddy guidance is unchanged.	2026-07-05 13:38:51 +02:00
Latte	39ce8005c0	feat(docker): image, compose, and env for remote-HTTP deployment ... - docker/Dockerfile: multi-stage uv wheel build; runtime runs `familiar serve` as a non-root user (uid 1000) on port 8080, /data volume for the encrypted token store, and a HEALTHCHECK against /healthz. No token is baked in — serve refuses to start without FAMILIAR_HTTP_TOKEN, so it's supplied at run time. - docker-compose.yml: joins an external `proxy` network (Traefik labels for TLS, nginx/Caddy documented as alternatives), read-only rootfs, tmpfs /tmp, no-new-privileges, cap_drop ALL, non-root, /healthz healthcheck. Pulls the published FAMILIAR_IMAGE with a local build as fallback; writes default off. - .env.example: every FAMILIAR_* knob incl. the bearer token, auth mode, the OAuth resource-server settings, and the insecure-bind escape hatch. - .dockerignore: keep local state (data/, *.enc, key) and dev files out.	2026-07-04 19:26:17 +02:00