# Server deployment

The production image builds the Webpack site with Node and serves the generated `dist/` directory with an unprivileged Nginx process on port `8080`. The container does not publish a host port; Traefik reaches it over an external Docker network.

The runtime is read-only, drops every Linux capability, cannot gain new privileges, uses a bounded in-memory `/tmp`, and has CPU, memory, process, and log limits. Browser security headers are set by Nginx, and the site makes no third-party font, icon, or script requests.

## Defaults

| Setting | Default |
| --- | --- |
| Domain | `fiwlabs.dev` |
| Traefik network | `proxy` |
| HTTPS entrypoint | `websecure` |
| Certificate resolver | `porkbun` |

Compose reads overrides from `.env`. The available keys and defaults are documented in `.env.example`.

## Prerequisites

1. Point the `A` and optional `AAAA` records for `fiwlabs.dev` to the server.
2. Ensure Traefik has its Docker provider enabled.
3. Attach Traefik to the same external network configured by `TRAEFIK_NETWORK`.
4. Ensure the configured certificate resolver exists in Traefik.

Create the default shared network once if the Traefik stack has not already created it:

```sh
docker network create proxy
```

## Deploy

Validate the resolved Compose configuration:

```sh
docker compose -f docker-compose.yml config
```

Build and start the site:

```sh
docker compose -f docker-compose.yml up --build -d
```

Check container health and logs:

```sh
docker compose -f docker-compose.yml ps
docker compose -f docker-compose.yml logs -f fiws-page
```

The container exposes `/healthz` internally for Docker health checks. Traefik serves the site at `https://fiwlabs.dev`; the server's `web` entrypoint redirects HTTP requests to HTTPS globally.