Initial commit: CodiMD Docker deployment with security hardening

- Add docker-compose.yml with PostgreSQL and CodiMD services
- Add .env.example for environment configuration template
- Add .gitignore to exclude sensitive data and persisted volumes
- Add CLAUDE.md documentation for deployment guidance
- Security hardening: read-only containers, health checks, network isolation

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

CLAUDE.md

@@ -0,0 +1,50 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+This directory contains Docker deployment configuration for CodiMD (now HackMD), a collaborative markdown editor. **This is not a source code repository** - the actual CodiMD source code is maintained at https://github.com/hackmdio/codimd.
+
+## Architecture
+
+This deployment consists of two Docker services:
+
+- **database**: PostgreSQL 16 Alpine with security hardening, stores data at `./pgdata/`
+- **codimd**: The main application (hackmdio/hackmd:2.6.1) serving on port 3000, with uploads stored at `./upload-data/`
+
+All persistent data is stored in the current directory:
+- `./pgdata/` - PostgreSQL database files
+- `./upload-data/` - User uploaded files
+
+## Running the Application
+
+```bash
+# First time setup: copy and customize environment variables
+cp .env.example .env
+# Edit .env with strong passwords
+
+# Start all services
+docker-compose up -d
+
+# View logs
+docker-compose logs -f
+
+# Stop services
+docker-compose down
+```
+
+The application will be available at http://localhost:3000 (bound to 127.0.0.1 only)
+
+## Security Configuration
+
+The deployment includes several security improvements:
+
+- **Environment variables**: All secrets stored in `.env` file (git-ignored)
+- **PostgreSQL hardening**: Read-only container, no new privileges, tmpfs for temporary data
+- **Network isolation**: Services communicate via internal Docker network, database not exposed externally
+- **Health checks**: Both services have health checks for proper startup sequencing
+- **Local-only binding**: CodiMD binds to 127.0.0.1, not accessible from external network
+- **Session secret**: Auto-generated random secret for session encryption
+
+**Important**: Change the default passwords in `.env` before production use.