# Docker deployment

The Compose deployment uses two containers made from the same image:

- `svelte-mud-app` runs the adapter-node SvelteKit build on port 3000.
- `svelte-mud-proxy` runs the WebSocket-to-Telnet proxy on port 3001.

Neither port is published to the host. Both services join the external `revproxy` network for access by Caddy.

## Deploy

1. Change `mud.iamtalon.me` in `docker-compose.yml` and `Caddyfile` to the actual public hostname.
2. Create the proxy network if it does not already exist:

   ```bash
   docker network create revproxy
   ```

3. Build and start both services:

   ```bash
   docker compose up --build -d
   ```

4. Inspect health and logs:

   ```bash
   docker compose ps
   docker compose logs -f
   ```

Stop the deployment with `docker compose down`.

## Reverse proxy

The included `Caddyfile` sends `/mud-ws` to `svelte-mud-proxy:3001` and other requests to `svelte-mud-app:3000`. It also installs a restrictive content security policy and related browser security headers.

`TRUST_PROXY=1` must only be used when clients cannot reach the proxy container directly and the forwarding proxy overwrites `X-Forwarded-For`. Otherwise remove it so connection quotas use the actual socket address.

`ALLOWED_ORIGINS` is an exact, comma-separated allowlist. For example:

```yaml
ALLOWED_ORIGINS: https://mud.example.com
```

Do not publish port 3001 publicly. Origin checks are a browser boundary, not an authentication mechanism.

## Updating

```bash
docker compose build --pull
docker compose up -d
```

The containers run as an unprivileged user and include independent health checks for the web app and proxy.