2 Commits

Author	SHA1	Message	Date
cesnimda	c877c61e3e	deploy: publish site on host port 1337; nginx proxies /api/contact; auto-deploy ... - site nginx listens on 1337; proxies /api/contact to the relay over the internal network (single public port; TLS terminates upstream at Cloudflare) - trailing-slash rewrite moved inside location / so /api/contact isn't redirected - compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels (non-destructive — does not touch the WordPress apex router) - .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-10 10:00:33 +02:00
cesnimda	9088dcffb9	feat: Docker images, compose stacks, nginx config, Gitea CI ... - site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 06:21:35 +02:00