Initial commit: CodiMD Docker deployment with security hardening

- Add docker-compose.yml with PostgreSQL and CodiMD services
- Add .env.example for environment configuration template
- Add .gitignore to exclude sensitive data and persisted volumes
- Add CLAUDE.md documentation for deployment guidance
- Security hardening: read-only containers, health checks, network isolation

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,62 @@
+services:
+  database:
+    image: postgres:16-alpine
+    container_name: codimd-postgres
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+      # PostgreSQL security settings
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - ./pgdata:/var/lib/postgresql/data
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - codimd-network
+    # Security: restrict to internal network only
+    ports: []
+    # Additional security options
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /var/run/postgresql
+
+  codimd:
+    image: hackmdio/hackmd:2.6.1
+    container_name: codimd-app
+    environment:
+      - CMD_DB_URL=${CMD_DB_URL}
+      - CMD_USECDN=false
+      - CMD_SESSION_SECRET=${CMD_SESSION_SECRET}
+      - CMD_SESSION_LIFETIME=1209600000
+      - CMD_PORT=3000
+    depends_on:
+      database:
+        condition: service_healthy
+    ports:
+      - "127.0.0.1:3000:3000"
+    volumes:
+      - ./upload-data:/home/hackmd/app/public/uploads
+    restart: always
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    networks:
+      - codimd-network
+    security_opt:
+      - no-new-privileges:true
+
+networks:
+  codimd-network:
+    driver: bridge
+    internal: false