feat: add one-command Traefik deployment

README.md

@@ -63,6 +63,43 @@ transmit preferences. Because Toolbox apps share an origin, code explicitly
 trusted in an app can access same-origin browser storage; review each app's
 privacy and executable-code warning. Light, dark, and system modes are supported.
 
+## Production deployment behind Traefik
+
+The committed `compose.yaml` is the shortest production path. Its release
+container downloads the immutable Toolbox 0.2.0 ZIP during the image build,
+verifies SHA-256 before extracting it, and then copies only the verified static
+files into the pinned unprivileged nginx image. Node.js and a local portal
+assembly are not required on the deployment host.
+
+Prerequisites:
+
+- Docker with the Compose plugin;
+- Traefik attached to the existing external Docker network `internal`;
+- a Traefik HTTPS entrypoint named `websecure`;
+- a certificate resolver named `netcup`;
+- DNS for `toolbax.add-ideas.de` pointing to that Traefik instance; and
+- outbound HTTPS access to `git.add-ideas.de` while the image is built.
+
+Deploy a fresh clone with:
+
+```sh
+git clone https://git.add-ideas.de/zemion/toolbox-portal.git
+cd toolbox-portal
+docker compose up -d --build
+docker compose ps
+```
+
+No host port is published. Traefik routes
+`https://toolbax.add-ideas.de` to nginx on the shared network at port 8080 and
+obtains its TLS certificate through `netcup`. The hostname, network, resolver,
+release version, and matching checksum can be overridden through environment
+variables; copy `.env.example` to `.env` only when an override is needed. For
+example, set `TOOLBOX_HOST=toolbox.add-ideas.de` if that spelling is preferred.
+
+The external network is deliberately not created by this project. Creating a
+private project-local network would prevent an independently managed Traefik
+container from reaching the service.
+
 ## Exact release assembly
 
 Every app release ZIP must put these items at its archive root:
@@ -150,7 +187,7 @@ npm run package:static -- \
 
 This also emits a `.sha256` sidecar.
 
-## Container image
+## Local assembled container and publication
 
 `Containerfile` serves only the assembled files with unprivileged nginx on port 8080. It adds restrictive browser headers, same-origin isolation, immutable
 caching only for Vite-hashed assets, and revalidation for all other files.
@@ -167,8 +204,11 @@ podman run --rm -p 8080:8080 \
   git.add-ideas.de/zemion/toolbox:0.2.0
 ```
 
-For a local deployment, copy `compose.example.yaml` to `compose.yaml` and run
-`docker compose up --build -d` (or the Podman Compose equivalent).
+For a direct-port local deployment after assembly, use the separate example:
+
+```sh
+docker compose -f compose.example.yaml up -d --build
+```
 
 Publish both common architectures from a buildx-enabled workstation or Gitea
 runner:
@@ -177,7 +217,7 @@ runner:
 docker login git.add-ideas.de
 docker buildx build \
   --platform linux/amd64,linux/arm64 \
-  --file Containerfile \
+  --file Containerfile.release \
   --tag git.add-ideas.de/zemion/toolbox:0.2.0 \
   --tag git.add-ideas.de/zemion/toolbox:0.2 \
   --push .