chore(deploy): single-container Dockerfile, Caddy, and Unraid template

Builds the container the "1 container" decision (D15) actually needs, which
D15 itself deferred as follow-up work: Caddy + the FastAPI app + the static
SvelteKit build in one image, SQLite on a mounted volume. See docs/DECISIONS.md
D16 for the specific choices and why (entrypoint-run migrations instead of a
separate deploy-pipeline step, tini + a small supervisor script instead of
s6-overlay/supervisord, copying the Caddy binary out of its official image).

Removes apps/api/Dockerfile and apps/web/Dockerfile from the old 4-container
compose plan (PR #4, closed as superseded) — the root Dockerfile replaces both
with one multi-stage build.

deploy/unraid-template.xml turns VELODROME_PUBLIC_URL, VELODROME_SECRET_KEY,
etc. into fillable Unraid Community Applications web UI fields, per the
earlier decision to keep config there instead of a .env file.

.gitea/workflows/release.yml builds and pushes the image to the Gitea registry
on a version tag or manual dispatch; it does not touch the running container.

Verified by actually running the built image, not just building it: the
health endpoint responds through Caddy's proxy, the SPA serves with working
client-route fallback, alembic ran and produced a real (non-empty) SQLite file
under /data, the process runs as the non-root velodrome user, and killing the
uvicorn process brings the whole container down (exit 143) rather than
leaving Caddy serving alone — confirming the entrypoint's coupled-lifetime
behavior actually holds, not just that it reads correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R2ZKeWkZV7ehf7fivrAkkG

deploy/Caddyfile

@@ -0,0 +1,31 @@
+# Single-container Caddy config (docs/DECISIONS.md D15). Serves the static SvelteKit build and
+# reverse-proxies /api/* to uvicorn on loopback — the same split apps/web/vite.config.ts's dev
+# proxy describes, just as Caddy directives instead of Vite's dev-server proxy.
+{
+	admin off
+	# Explicit, not just implied by using a bare port below: this container is never the TLS
+	# terminator (docs/PLAN.md "Service topology" — the host's existing reverse proxy is), so
+	# Caddy must never attempt to provision a certificate for whatever it's fronted by.
+	auto_https off
+}
+
+:8080 {
+	encode gzip
+
+	log {
+		output stdout
+	}
+
+	handle /api/* {
+		reverse_proxy 127.0.0.1:8000
+	}
+
+	# SPA fallback matching apps/web/vite.config.ts's `adapter({ fallback: 'index.html' })`:
+	# any path that isn't a real built file resolves to index.html so client-side routing works
+	# on a hard refresh / direct link.
+	handle {
+		root * /srv/web
+		try_files {path} /index.html
+		file_server
+	}
+}

deploy/README.md

@@ -1 +1,86 @@
-docker-compose, Caddyfile, systemd backup units. Not yet written — Phase 0.
+# deploy/
+
+Everything needed to run Velodrome as **one container**. See `docs/DECISIONS.md` D15 (why SQLite
+and one container) and D16 (why migrations run from the entrypoint, and the Caddy/tini setup)
+before changing anything here.
+
+```
+../Dockerfile          Multi-stage build: web SPA + API venv + Caddy, into one runtime image
+Caddyfile               Serves the static SPA, proxies /api/* to uvicorn on loopback
+entrypoint.sh           Runs migrations, then supervises uvicorn + Caddy as PID 1's children
+unraid-template.xml     Unraid Community Applications template — turns the env vars below into
+                        fillable web UI fields instead of a .env file
+```
+
+There is no docker-compose here, deliberately — the app is one container, not a set of services
+that need orchestrating together. (Later phases may add genuinely separate containers — a
+tileserver, a local LLM — see `docs/PLAN.md`'s "Service topology"; those would get their own
+compose file or Unraid templates when a phase actually needs one, not speculatively now.)
+
+## Build
+
+From the repo root (the build context — the Dockerfile needs both `apps/api` and `apps/web`):
+
+```sh
+docker build -t velodrome .
+```
+
+## Run
+
+```sh
+docker run -d \
+  --name velodrome \
+  -p 8080:8080 \
+  -v velodrome-data:/data \
+  -e VELODROME_PUBLIC_URL=https://bikes.example.com \
+  -e VELODROME_SECRET_KEY=$(openssl rand -hex 32) \
+  -e VELODROME_ENVIRONMENT=production \
+  velodrome
+```
+
+Put a TLS-terminating reverse proxy (whatever's already fronting other services on the host) in
+front of port 8080 — this container only ever serves plain HTTP itself.
+
+`GET http://<host>:8080/api/v1/healthz` should return `{"status": "ok"}` once it's up.
+
+## Environment variables
+
+All read by `apps/api/velodrome/config.py` (prefix `VELODROME_`) — the app and Alembic both read
+the same values, there's no separate migration-time config anymore (docs/DECISIONS.md D15).
+
+| Variable | Required | Default (baked into the image) | Notes |
+|---|---|---|---|
+| `VELODROME_DATABASE_URL` | No — don't override | `sqlite+aiosqlite:////data/velodrome.db` | Fixed to the `/data` volume mount. Change the volume mapping, not this. |
+| `VELODROME_PUBLIC_URL` | **Yes** | none | The externally-visible URL. Checked against `Origin` on cookie-authenticated mutations — get this wrong and every logged-in write silently 403s. |
+| `VELODROME_SECRET_KEY` | **Yes** | insecure dev placeholder | `openssl rand -hex 32`. Not yet used for anything reachable (arrives with Bryton credential encryption in a later phase) — set a real value now anyway. |
+| `VELODROME_ENVIRONMENT` | **Yes** | `development` | `development` \| `test` \| `production`. Gates the session cookie's `Secure` flag — always `production` behind real HTTPS. |
+| `VELODROME_SESSION_TTL_DAYS` | No | `90` | Login session lifetime. |
+| `VELODROME_SESSION_COOKIE_NAME` | No | `vd_session` | Only matters if it collides with another app on the same domain. |
+
+## Volumes
+
+| Path | Contents |
+|---|---|
+| `/data` | The SQLite database file. Will also hold the content-addressed blob store once Phase 1 builds ingestion. This is the only thing that needs backing up. |
+
+## Unraid
+
+Import `unraid-template.xml` from the Docker tab's "Add Container" template picker — it exposes
+the Port, Data path, and the env vars above as fillable web UI fields, matching the earlier
+decision to keep configuration in Unraid's own UI rather than a `.env` file on disk. Every field
+stays editable by hand afterward regardless of what the template pre-fills.
+
+## Publishing the image
+
+`.gitea/workflows/release.yml` builds this Dockerfile and pushes it to the Gitea container
+registry (`192.168.0.3:3000/bbergle/bike-app`) on a `v*` tag push, or on manual
+`workflow_dispatch`. It does **not** SSH into the host and recreate the running container —
+rolling out a new image on Unraid (pulling it and clicking "Apply" on the container, or via
+Unraid's own update-checking) is left as a manual/Unraid-side step, not something CI does
+unattended.
+
+## What's not here yet
+
+Backups (`docs/PLAN.md` calls for a systemd timer running `restic` against `/data`, independent of
+CI) and the `import_inbox` USB-watch bind mount are both Phase 1+ concerns — nothing in the schema
+uses them yet.

deploy/entrypoint.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# Single-container entrypoint (docs/DECISIONS.md D16). Two responsibilities:
+#
+# 1. Run migrations before serving anything. There's no separate "run migrations, then start the
+#    app" step in front of this container the way docs/PLAN.md's original deploy.yml had one for
+#    the 3-container Postgres stack (see apps/api/Dockerfile's history) — a single container has
+#    nowhere else to put that step. `set -e` means a failed migration exits non-zero here, which
+#    still fails startup visibly (Docker/Unraid shows the container as exited/restarting) instead
+#    of silently serving a broken app; that's the property the separate step existed to protect,
+#    preserved by a different mechanism now that there's only one container to do it in.
+# 2. Run uvicorn and Caddy as two background processes and tie their lifetimes together: if either
+#    one dies, kill the other and exit with its status, so Docker/Unraid restarts the whole
+#    container. Two half-alive processes (API up, web serving stale/nothing, or vice versa) is a
+#    worse failure mode than a clean restart.
+set -euo pipefail
+
+alembic -c /app/alembic.ini upgrade head
+
+# uvicorn binds loopback only — Caddy is the sole process with an exposed port, and the sole
+# thing that talks to uvicorn (see deploy/Caddyfile's reverse_proxy target).
+uvicorn velodrome.app:app --host 127.0.0.1 --port 8000 &
+API_PID=$!
+
+caddy run --config /etc/caddy/Caddyfile --adapter caddyfile &
+CADDY_PID=$!
+
+trap 'kill -TERM "$API_PID" "$CADDY_PID" 2>/dev/null || true' TERM INT
+
+wait -n "$API_PID" "$CADDY_PID"
+EXIT_CODE=$?
+kill -TERM "$API_PID" "$CADDY_PID" 2>/dev/null || true
+exit "$EXIT_CODE"

deploy/unraid-template.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<!--
+  Unraid Docker "Template" for Community Applications' Add-Container form. This is what turns the
+  env vars in the table below into fillable fields in the Unraid web UI instead of a .env file —
+  see docs/DECISIONS.md D16 for why this exists.
+
+  Import: Docker tab -> Add Container -> Template drop-down -> pick this file (or paste the
+  "Template" URL if this repo is served over http from the Gitea instance). Every field is also
+  editable by hand afterward; nothing here is load-bearing beyond being a starting point.
+-->
+<Container version="2">
+	<Name>velodrome</Name>
+	<Repository>192.168.0.3:3000/bbergle/bike-app:latest</Repository>
+	<Registry>http://192.168.0.3:3000/BBergle/-/packages/container/bike-app</Registry>
+	<Network>bridge</Network>
+	<Privileged>false</Privileged>
+	<Support>https://192.168.0.3:3000/BBergle/bike-app/issues</Support>
+	<Project>http://192.168.0.3:3000/BBergle/bike-app</Project>
+	<Overview>Self-hosted cycling app: Bryton Rider 650 ride sync, mileage tracking, spare-parts inventory, and maintenance reminders. One container: Caddy + the FastAPI app + a SQLite database file on the Data path below. See docs/PLAN.md and docs/DECISIONS.md (D15/D16) in the repo for the design.</Overview>
+	<Category>Productivity:</Category>
+	<WebUI>http://[IP]:[PORT:8080]/</WebUI>
+	<Icon/>
+	<ExtraParams/>
+	<PostArgs/>
+	<CPUset/>
+	<DateInstalled/>
+	<DonateText/>
+	<DonateLink/>
+	<Description>Self-hosted cycling app: Bryton ride sync, mileage tracking, spare-parts inventory, maintenance reminders.</Description>
+	<Config Name="Web UI Port" Target="8080" Default="8080" Mode="tcp" Description="Container's HTTP port. Put a reverse proxy with TLS in front of this — the container itself only ever serves plain HTTP (docs/PLAN.md 'Service topology')." Type="Port" Display="always" Required="true" Mask="false">8080</Config>
+	<Config Name="Data" Target="/data" Default="/mnt/user/appdata/velodrome" Mode="rw" Description="The SQLite database file (and, in a later phase, the raw-file blob store) live here. This is the only thing worth backing up." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/velodrome</Config>
+	<Config Name="VELODROME_PUBLIC_URL" Target="VELODROME_PUBLIC_URL" Default="" Mode="" Description="The externally-visible URL this instance is reachable at, e.g. https://bikes.example.com. Must match exactly what's in the browser's address bar — it's checked against the Origin header on cookie-authenticated requests to stop cross-site request forgery." Type="Variable" Display="always" Required="true" Mask="false"></Config>
+	<Config Name="VELODROME_SECRET_KEY" Target="VELODROME_SECRET_KEY" Default="" Mode="" Description="A random secret, 32+ bytes. Generate one with: openssl rand -hex 32. The image ships an insecure development placeholder — always override this before exposing the container to anything." Type="Variable" Display="always" Required="true" Mask="true"></Config>
+	<Config Name="VELODROME_ENVIRONMENT" Target="VELODROME_ENVIRONMENT" Default="production" Mode="" Description="development | test | production. Gates the session cookie's Secure flag — leave this as production for any deployment reachable over HTTPS." Type="Variable" Display="always" Required="true" Mask="false">production</Config>
+	<Config Name="VELODROME_SESSION_TTL_DAYS" Target="VELODROME_SESSION_TTL_DAYS" Default="90" Mode="" Description="Days before a login session expires and re-authentication is required." Type="Variable" Display="advanced" Required="false" Mask="false">90</Config>
+	<Config Name="VELODROME_SESSION_COOKIE_NAME" Target="VELODROME_SESSION_COOKIE_NAME" Default="vd_session" Mode="" Description="Name of the session cookie. No reason to change this unless it collides with another app on the same domain." Type="Variable" Display="advanced" Required="false" Mask="false">vd_session</Config>
+</Container>