Harden client and WebSocket proxy

DOCKER-README.md

@@ -1,77 +1,55 @@
-# Svelte MUD Docker Setup
+# Docker deployment
 
-This guide explains how to use Docker to build and run the Svelte MUD client.
+The Compose deployment uses two containers made from the same image:
 
-## Solution Overview
+- `svelte-mud-app` runs the adapter-node SvelteKit build on port 3000.
+- `svelte-mud-proxy` runs the WebSocket-to-Telnet proxy on port 3001.
 
-This setup runs both the SvelteKit application and the WebSocket server in a single container, avoiding CORS issues. It follows the same approach used in development, where both servers run as separate processes but within the same context.
+Neither port is published to the host. Both services join the external `revproxy` network for access by Caddy.
 
-## Prerequisites
+## Deploy
 
-- [Docker](https://docs.docker.com/get-docker/)
-- [Docker Compose](https://docs.docker.com/compose/install/) (usually included with Docker Desktop)
+1. Change `mud.iamtalon.me` in `docker-compose.yml` and `Caddyfile` to the actual public hostname.
+2. Create the proxy network if it does not already exist:
 
-## Quick Start
-
-1. Navigate to the project directory:
    ```bash
-   cd path/to/svelte-mud
+   docker network create revproxy
    ```
 
-2. Build and start the container:
+3. Build and start both services:
+
    ```bash
-   docker-compose up -d
+   docker compose up --build -d
    ```
 
-3. Access the application:
-   - Web interface: http://localhost:3000
-   - WebSocket server: ws://localhost:3001/mud-ws
+4. Inspect health and logs:
 
-## Docker Commands
+   ```bash
+   docker compose ps
+   docker compose logs -f
+   ```
 
-### Starting the Application
+Stop the deployment with `docker compose down`.
+
+## Reverse proxy
+
+The included `Caddyfile` sends `/mud-ws` to `svelte-mud-proxy:3001` and other requests to `svelte-mud-app:3000`. It also installs a restrictive content security policy and related browser security headers.
+
+`TRUST_PROXY=1` must only be used when clients cannot reach the proxy container directly and the forwarding proxy overwrites `X-Forwarded-For`. Otherwise remove it so connection quotas use the actual socket address.
+
+`ALLOWED_ORIGINS` is an exact, comma-separated allowlist. For example:
+
+```yaml
+ALLOWED_ORIGINS: https://mud.example.com
+```
+
+Do not publish port 3001 publicly. Origin checks are a browser boundary, not an authentication mechanism.
+
+## Updating
 
 ```bash
-# Build and start in detached mode
-docker-compose up -d
-
-# Build and start with logs
-docker-compose up
-
-# Force rebuild
-docker-compose up --build
+docker compose build --pull
+docker compose up -d
 ```
 
-### Stopping the Application
-
-```bash
-# Stop containers
-docker-compose down
-```
-
-### Viewing Logs
-
-```bash
-# View logs
-docker-compose logs -f
-```
-
-## Caddy Configuration
-
-For use with Caddy as a reverse proxy, use this simple configuration:
-
-```
-mud.example.com {
-    reverse_proxy svelte-mud:3000
-}
-```
-
-Both the web interface and WebSocket connections will be routed correctly through this single reverse proxy rule.
-
-## Troubleshooting
-
-If you encounter any issues, check the container logs:
-
-```bash
-docker-compose logs -f
-```
+The containers run as an unprivileged user and include independent health checks for the web app and proxy.