Fixed public deployment

The public demo is hosted directly on the server at https://511.kendeji.fun. Caddy terminates HTTPS and proxies only to the container port bound on 127.0.0.1:8511; the application port is not exposed to the public network.

The server layout is:

/opt/511-project/
├── .env                 # OpenAI connection settings, mode 0600
├── .env.auth            # Web authentication settings, mode 0600
├── deploy/server/
├── artifacts/runs/      # Persistent request artifacts
└── artifacts/user-presets/

Build and start the service:

cd /opt/511-project
chown -R root:root artifacts/runs artifacts/user-presets
chmod 0700 artifacts/runs artifacts/user-presets
docker compose -f deploy/server/compose.yaml up -d --build
docker compose -f deploy/server/compose.yaml ps

Add deploy/server/Caddyfile.example to the host Caddyfile, validate, and reload Caddy:

caddy validate --config /etc/caddy/Caddyfile
systemctl restart caddy

This host disables Caddy's admin endpoint, so caddy reload and systemctl reload caddy cannot apply configuration. Validate first, then use a service restart.

Operational checks:

curl -I https://511.kendeji.fun/
docker compose -f /opt/511-project/deploy/server/compose.yaml logs --tail=100
systemctl status caddy

Never place .env, .env.auth, API keys, login passwords, or SSH credentials inside the image or source control. Updating the application uses the same source synchronization followed by docker compose ... up -d --build.