Attempt to be prod ready

README.md

@@ -39,6 +39,47 @@ docker compose exec php php bin/console app:seed-demo-albums --count=40 --attach
 docker compose exec php php bin/console app:seed-demo-reviews --cover-percent=70 --max-per-album=8
 ```
 
+## Production container (immutable)
+
+The repository ships with a single-container production target that bundles PHP-FPM, Nginx, your code, and a self-contained SQLite database. The build bakes in the `APP_ENV=prod` flag so production-only Symfony config is used automatically, and no bind mounts are required at runtime.
+
+1. Build the image (uses `docker/php/Dockerfile`'s `prod` stage):
+
+```bash
+docker build \
+  --target=prod \
+  -t tonehaus-app:latest \
+  -f docker/php/Dockerfile \
+  .
+```
+
+2. Run the container (listens on port 8080 inside the container):
+
+```bash
+docker run -d \
+  --name tonehaus \
+  -p 8080:8080 \
+  -e APP_ENV=prod \
+  -e APP_SECRET=change_me \
+  -e SPOTIFY_CLIENT_ID=your_client_id \
+  -e SPOTIFY_CLIENT_SECRET=your_client_secret \
+  tonehaus-app:latest
+```
+
+   - The runtime defaults to `DATABASE_DRIVER=sqlite` and stores the database file inside the image at `var/data/database.sqlite`. On each boot the entrypoint runs Doctrine migrations (safe to re-run) so the schema stays current while the container filesystem remains immutable from the host's perspective.
+   - To point at Postgres (or any external database), override `DATABASE_DRIVER` and `DATABASE_URL` at `docker run` time and optionally disable auto-migration with `RUN_MIGRATIONS_ON_START=0`.
+   - Health endpoint: `GET /healthz` on the published port (example: `curl http://localhost:8080/healthz`).
+
+3. Rebuild/redeploy by re-running the `docker build` command; no manual steps or bind mounts are involved.
+
+## Continuous integration
+
+- `.github/workflows/ci.yml` runs on pushes and pull requests targeting `main` or `prod`.
+- Job 1 installs Composer deps, prepares a SQLite database, runs Doctrine migrations, and executes the PHPUnit suite under PHP 8.2 so functional regressions are caught early.
+- Job 2 builds the production Docker image (`docker/php/Dockerfile` prod stage), checks that key Symfony artifacts (e.g., `public/index.php`, `bin/console`) are present, ensures `APP_ENV=prod` is baked in, and smoke-tests the `/entrypoint.sh` startup path.
+- The resulting artifact mirrors the immutable container described above, so a green CI run guarantees the repo can be deployed anywhere via `docker run`.
+- Self-hosted runners can use `.gitea/workflows/ci.yml`, which mirrors the GitHub workflow but also supports optional registry pushes after the image passes the same verification steps.
+
 ## Database driver
 
 - Set `DATABASE_DRIVER=postgres` (default) to keep using the Postgres 16 container defined in `docker-compose.yml`.