fiws-page/DEPLOY.md

Server deployment

The production image builds the Webpack site with Node and serves the generated dist/ directory with an unprivileged Nginx process on port 8080. The container does not publish a host port; Traefik reaches it over an external Docker network.

The runtime is read-only, drops every Linux capability, cannot gain new privileges, uses a bounded in-memory /tmp, and has CPU, memory, process, and log limits. Browser security headers are set by Nginx, and the site makes no third-party font, icon, or script requests.

Defaults

Setting	Default
Domain	fiwlabs.dev
Traefik network	proxy
HTTPS entrypoint	websecure
Certificate resolver	porkbun

Compose reads overrides from .env. The available keys and defaults are documented in .env.example.

Prerequisites

1. Point the A and optional AAAA records for fiwlabs.dev to the server.
2. Ensure Traefik has its Docker provider enabled.
3. Attach Traefik to the same external network configured by TRAEFIK_NETWORK.
4. Ensure the configured certificate resolver exists in Traefik.

Create the default shared network once if the Traefik stack has not already created it:

docker network create proxy

Deploy

Validate the resolved Compose configuration:

docker compose -f docker-compose.yml config

Build and start the site:

docker compose -f docker-compose.yml up --build -d

Check container health and logs:

docker compose -f docker-compose.yml ps
docker compose -f docker-compose.yml logs -f fiws-page

The container exposes /healthz internally for Docker health checks. Traefik serves the site at https://fiwlabs.dev; the server's web entrypoint redirects HTTP requests to HTTPS globally.