blazor.web.js issues

README.md

@@ -42,6 +42,59 @@ EntKube/
 └── EntKube.Client/   # WebAssembly client project
 ```
 
+## Docker
+
+### Build and push
+
+> **Apple Silicon (M-series) Mac:** servers are typically `linux/amd64`. Use `docker buildx` to cross-compile and push in one step — the `--push` flag is required because multi-platform images cannot be loaded into the local Docker daemon.
+
+```bash
+# One-time setup
+docker buildx create --use --name multiarch
+
+# Build for amd64 and push directly to the registry
+docker buildx build --platform linux/amd64 \
+  -t entit.azurecr.io/entkube:latest \
+  --push .
+
+# Tag a versioned release
+docker buildx build --platform linux/amd64 \
+  -t entit.azurecr.io/entkube:latest \
+  -t entit.azurecr.io/entkube:1.0.0 \
+  --push .
+```
+
+Replace `entit.azurecr.io/entkube` with your actual registry and image path.
+
+### Run with Docker Compose
+
+Copy `.env.example` to `.env` and fill in the required values, then authenticate with the registry and start the stack:
+
+```bash
+# Authenticate with the container registry (once per machine / token expiry)
+docker login entit.azurecr.io -u $REGISTRY_USERNAME -p $REGISTRY_PASSWORD
+
+docker compose up -d
+```
+
+The app will be available at `http://localhost:8080`.
+
+> **Data safety** — `docker compose down` does **not** delete the database volume.
+> Only `docker compose down -v` removes volumes.
+
+### Required configuration
+
+| Variable | Description |
+|---|---|
+| `DOMAIN` | Public domain pointing at the server (e.g. `entkube.example.com`). |
+| `ACME_EMAIL` | Email for Let's Encrypt account and expiry notices. |
+| `Vault__RootKey` | 32-byte base64 key for secret encryption. Generate with `openssl rand -base64 32`. |
+| `POSTGRES_PASSWORD` | Password for the Postgres database (set in `.env`). |
+
+### TLS / HTTPS
+
+Caddy is the reverse proxy and handles TLS automatically. On first start it obtains a Let's Encrypt certificate for `DOMAIN` and renews it automatically before it expires. Ports **80** and **443** must be open and your DNS must point at the server before starting the stack.
+
 ## License
 
 See [LICENSE](LICENSE).