npeter83 a322f87caf chore(deploy): hardened prod compose, rollout script, and CI for the server ... docker-compose.prod.yml targets the server: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main.		2026-06-14 01:39:43 +02:00
..
ci.yml	chore(deploy): hardened prod compose, rollout script, and CI for the server	2026-06-14 01:39:43 +02:00