# Fixed public deployment

The public demo is hosted directly on the server at
`https://511.kendeji.fun`. Caddy terminates HTTPS and proxies only to the
container port bound on `127.0.0.1:8511`; the application port is not exposed
to the public network.

The server layout is:

```text
/opt/511-project/
├── .env                 # OpenAI connection settings, mode 0600
├── .env.auth            # Web authentication settings, mode 0600
├── deploy/server/
├── artifacts/runs/      # Persistent request artifacts
└── artifacts/user-presets/
```

Build and start the service:

```bash
cd /opt/511-project
chown -R root:root artifacts/runs artifacts/user-presets
chmod 0700 artifacts/runs artifacts/user-presets
docker compose -f deploy/server/compose.yaml up -d --build
docker compose -f deploy/server/compose.yaml ps
```

Add `deploy/server/Caddyfile.example` to the host Caddyfile, validate, and
reload Caddy:

```bash
caddy validate --config /etc/caddy/Caddyfile
systemctl restart caddy
```

This host disables Caddy's admin endpoint, so `caddy reload` and
`systemctl reload caddy` cannot apply configuration. Validate first, then use a
service restart.

Operational checks:

```bash
curl -I https://511.kendeji.fun/
docker compose -f /opt/511-project/deploy/server/compose.yaml logs --tail=100
systemctl status caddy
```

Never place `.env`, `.env.auth`, API keys, login passwords, or SSH credentials
inside the image or source control. Updating the application uses the same
source synchronization followed by `docker compose ... up -d --build`.