Production deploy for musicshare.binarygnome.com

- docker-compose.prod.yml overlay: Caddy with automatic HTTPS on one
  origin (web at /, API at /api incl. websocket), internal-only Postgres/
  Redis/API/web, secure cookies, private-network servers blocked, nightly
  pg_dump backups kept 14 days
- deploy/export-db.sh and import-db.sh to carry a database to the server
  (same TOKEN_ENCRYPTION_KEY required for stored connections)
- Base compose no longer requires apps/api/.env
- README: deployment, Spotify via scrobblers, SMTP settings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

deploy/Caddyfile

@@ -0,0 +1,24 @@
+# One public origin for everything. Caddy fetches and renews the HTTPS certificate itself.
+#   https://musicshare.binarygnome.com/        -> web app
+#   https://musicshare.binarygnome.com/api/... -> API (prefix stripped; includes the /api/ws websocket)
+{$DOMAIN} {
+	encode zstd gzip
+
+	handle_path /api/* {
+		reverse_proxy api:4000
+	}
+
+	handle {
+		reverse_proxy web:3737
+	}
+
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		-Server
+	}
+
+	log {
+		output stdout
+		format console
+	}
+}

deploy/export-db.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Save the local database to a file you can carry to the server.
+#   deploy/export-db.sh [output-file]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+out="${1:-musicshare-$(date +%Y%m%d-%H%M).dump}"
+docker compose exec -T postgres pg_dump -U musicshare -d musicshare --format=custom --no-owner > "$out"
+echo "Saved $(du -h "$out" | cut -f1) to $out"
+echo
+echo "IMPORTANT: connected services (Plex, Last.fm, Jellyfin...) are encrypted with TOKEN_ENCRYPTION_KEY."
+echo "Put the SAME key in deploy/production.env on the server, or those connections must be redone:"
+grep '^TOKEN_ENCRYPTION_KEY=' apps/api/.env 2>/dev/null | sed 's/=.*/=<copy the value from apps\/api\/.env>/' || true

deploy/import-db.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Restore a dump from export-db.sh on the server, replacing what's there.
+#   deploy/import-db.sh <dump-file>
+set -euo pipefail
+cd "$(dirname "$0")/.."
+file="${1:?usage: deploy/import-db.sh <dump-file>}"
+compose=(docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file deploy/production.env)
+
+echo "This REPLACES the server's database with $file."
+read -r -p "Type 'replace' to continue: " answer
+[ "$answer" = "replace" ] || { echo "Aborted."; exit 1; }
+
+"${compose[@]}" stop api worker web
+"${compose[@]}" up -d postgres
+until "${compose[@]}" exec -T postgres pg_isready -U musicshare -d musicshare >/dev/null 2>&1; do sleep 1; done
+"${compose[@]}" exec -T postgres pg_restore -U musicshare -d musicshare --clean --if-exists --no-owner < "$file"
+# Apply any migrations newer than the dump, then bring everything back.
+"${compose[@]}" run --rm migrate
+"${compose[@]}" up -d
+echo "Restored. Everyone needs to sign in again (sessions are per-domain), and Plex/Jellyfin webhook URLs now use the new domain."

deploy/production.env.example

@@ -0,0 +1,28 @@
+# Copy to deploy/production.env on the server and fill in. Never commit the real file.
+
+DOMAIN=musicshare.binarygnome.com
+
+# Generate each with: openssl rand -base64 32
+POSTGRES_PASSWORD=
+TOKEN_ENCRYPTION_KEY=
+
+# Optional: exact "Open in Spotify" links (catalog search only; no user sign-in)
+SPOTIFY_CLIENT_ID=
+SPOTIFY_CLIENT_SECRET=
+LASTFM_API_KEY=
+LASTFM_SHARED_SECRET=
+ODESLI_API_KEY=
+PLEX_CLIENT_ID=musicshare
+APPLE_TEAM_ID=
+APPLE_MUSICKIT_KEY_ID=
+APPLE_MUSICKIT_PRIVATE_KEY=
+
+# Optional donation link shown on the website
+DONATION_URL=
+
+# Outgoing email (verification, password reset). SMTPS on 465.
+SMTP_HOST=
+SMTP_PORT=465
+SMTP_USER=
+SMTP_PASSWORD=
+MAIL_FROM=musicshare <app@musicshare.binarygnome.com>