feat: docker-compose prod setup

README.md

@@ -183,12 +183,70 @@ Useful `just` commands:
 - `just reset-database` — reset local DB  
 - `just regen-migrations <name>` — regenerate migrations  
 
-## 📦 Deployment
+## 📦 Production Deployment
 
-A production release image is built via the provided `Dockerfile`.  
-Entrypoint: `/app/bin/server`.  
+### Local Production Testing
+
+For testing the production Docker build locally:
+
+1. **Generate secrets:**
+   ```bash
+   mix phx.gen.secret  # for SECRET_KEY_BASE
+   mix phx.gen.secret  # for TOKEN_SIGNING_SECRET
+   ```
+
+2. **Create `.env` file:**
+   ```bash
+   # Copy template and edit
+   cp .env.example .env
+   nano .env
+   
+   # Required variables:
+   SECRET_KEY_BASE=<your-generated-secret>
+   TOKEN_SIGNING_SECRET=<your-generated-secret>
+   PHX_HOST=localhost
+   
+   # Optional (have defaults in docker-compose.prod.yml):
+   # OIDC_CLIENT_ID=mv
+   # OIDC_BASE_URL=http://localhost:8080/auth/v1
+   # OIDC_REDIRECT_URI=http://localhost:4001/auth/user/rauthy/callback
+   # OIDC_CLIENT_SECRET=<from-rauthy-client>
+   ```
+
+3. **Start development environment** (for Rauthy):
+   ```bash
+   docker compose up -d
+   ```
+
+4. **Build and start production environment:**
+   ```bash
+   docker compose -f docker-compose.prod.yml up --build
+   ```
+
+5. **Run database migrations:**
+   ```bash
+   docker compose -f docker-compose.prod.yml exec app /app/bin/mv eval "Mv.Release.migrate"
+   ```
+
+6. **Access the production app:**
+   - Production App: http://localhost:4001
+   - Uses same Rauthy instance as dev (localhost:8080)
+
+**Note:** The local production setup uses `network_mode: host` to share localhost with the development Rauthy instance. For real production deployment, configure an external OIDC provider and remove `network_mode: host`.
+
+### Real Production Deployment
+
+For actual production deployment:
+
+1. **Use an external OIDC provider** (not the local Rauthy)
+2. **Update `docker-compose.prod.yml`:**
+   - Remove `network_mode: host`
+   - Set `OIDC_BASE_URL` to your production OIDC provider
+   - Configure proper Docker networks
+3. **Set up SSL/TLS** (e.g., via reverse proxy like Nginx/Traefik)
+4. **Use secure secrets management** (environment variables, Docker secrets, vault)
+5. **Configure database backups**
 
-More detailed deployment docs are planned.  
 
 ## 🤝 Contributing