- .dockerignore excludes .git, node_modules, certs, *.zip - Dockerfile runs as non-root appuser - compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks - deploy.sh snapshots binary before pull and rolls back on failed health check
Single script: git pull, make build, systemctl restart. Nvm is sourced inside the script (server now has node v22.23.1 installed). Run via: ssh dumpsterchat /opt/dumpsterChat/deploy.sh