switched to fully self contained docker

README.md

@@ -1,35 +1,30 @@
 # TAPM Deployment Access
 
 TAPM Deployment Access is a short-lived authorization broker for protected
-deployment packages and installer actions. Technicians authenticate with
-Gitea, create a deployment code, and permit a limited number of hosts to use
-explicitly selected capabilities during a fixed authorization window.
+deployment packages and installer actions. Technicians authenticate through
+the bundled Gitea service, create deployment codes, and authorize a limited
+number of hosts for selected capabilities.
 
-Default policy:
+The production layout is a self-contained, single-VM Docker deployment:
 
-- Public URL: `https://tapm.scity.us`
-- Authorization lifetime: 3 hours
-- Host limit: 3
-- Authentication: Gitea OAuth
-- Shared state: MariaDB Galera
-- Package storage: private Gitea Generic Package Registry
+- Go broker with a persistent embedded SQLite database
+- rootless Gitea with SQLite, repositories, and package registry
+- Nginx reverse proxy for both public domains
+- Certbot and Let's Encrypt HTTP-01 certificate management
+- explicit runtime storage under `config/` beside the Compose files
 
-See [docs/deployment.md](docs/deployment.md) for installation and configuration.
-The ProxMenu integration contract is documented in
-[docs/client-api.md](docs/client-api.md).
+No external database or load balancer is required. The datacenter edge only
+needs to forward TCP 80, 443, and 2222 to the Docker VM.
 
-## Components
-
-- `cmd/server`: portal, OAuth flow, authorization API, uploads, and downloads
-- `cmd/migrate`: ordered MariaDB schema migrations with an advisory lock
-- `internal/app`: application, security, and registry proxy logic
-- `deploy/nginx`: TLS reverse-proxy example
-- `compose.yaml`: hardened, host-networked container deployment
+See [docs/deployment.md](docs/deployment.md) for the installation, Gitea setup,
+TLS bootstrap, repository move, renewal, backup, and update procedures. The
+ProxMenu integration contract is in [docs/client-api.md](docs/client-api.md).
 
 ## Local checks
 
 ```sh
-docker run --rm -v "$PWD:/src" -w /src golang:1.24-alpine \
-  sh -c 'gofmt -w cmd internal && go test ./...'
+GOCACHE=/tmp/tapm-go-cache go test ./...
+docker compose --env-file .env.example config
+docker compose --env-file .env.example -f deploy/gitea/compose.yaml config
 docker build -t tai/tapm-deployment-broker:local .
 ```