Lock down proxy and docs

Author: AnastaZIuk

Caddyfile

@@ -1,6 +1,7 @@
 :3000 {
  respond /healthz 200
- handle_path /blog* {
+ redir /blog /blog/ 308
+ handle /blog* {
  reverse_proxy blog:3000
  }
  handle {

README.md

@@ -3,10 +3,12 @@ This repo is a Next.js app used to generate a static site. The final production
 ## Development (local only)
 - Install deps: `npm install`
 - Run dev server: `npm run dev` then open http://localhost:3000
+> ⚠️ These steps are purely for local development; the production image ships only static assets and never contains a Node/npm runtime.
 
 ## Build (production image)
 - `docker build -t www-website .`
 - Runtime is static files only; mount/serve with RO filesystem (e.g., `docker run --read-only --tmpfs /tmp --tmpfs /config --tmpfs /data -p 3000:3000 www-website`).
+> ⚠️ The final container maps only the generated `out` directory and static assets; keep it read-only and do not run any Node/npm scripts there.
 
 ## Deployment notes
 - Published image: `ghcr.io/devsh-graphics-programming/www-website` (tags: `latest`, `master`, `sha-*`).

docker-compose.yml

@@ -4,18 +4,20 @@ services:
  image: devsh-website
  read_only: true
  tmpfs:
- - /tmp
- - /config
- - /data
+ - /tmp:size=32m
+ - /config:size=32m
+ - /data:size=32m
  restart: unless-stopped
 
  blog:
  image: ${BLOG_IMAGE:-ghcr.io/devsh-graphics-programming/www-blog:latest}
+ ports:
+ - "3001:3000"
  read_only: true
  tmpfs:
- - /tmp
- - /config
- - /data
+ - /tmp:size=32m
+ - /config:size=16m
+ - /data:size=16m
  restart: unless-stopped
 
  proxy: