Initial commit: CodiMD Docker deployment with security hardening

- Add docker-compose.yml with PostgreSQL and CodiMD services
- Add .env.example for environment configuration template
- Add .gitignore to exclude sensitive data and persisted volumes
- Add CLAUDE.md documentation for deployment guidance
- Security hardening: read-only containers, health checks, network isolation

Co-Authored-By: Claude Sonnet 4 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,10 @@
+# Database Configuration
+POSTGRES_USER=codimd
+POSTGRES_PASSWORD=CHANGE_THIS_TO_A_STRONG_PASSWORD
+POSTGRES_DB=codimd
+
+# CodiMD Configuration
+CMD_DB_URL=postgres://codimd:CHANGE_THIS_TO_A_STRONG_PASSWORD@database/codimd
+
+# CodiMD Session Secret (generate a random string)
+CMD_SESSION_SECRET=CHANGE_THIS_TO_A_RANDOM_SECRET_STRING

.gitignore

@@ -0,0 +1,8 @@
+# Environment variables with sensitive data
+.env
+
+# PostgreSQL data
+pgdata/
+
+# CodiMD uploaded files
+upload-data/

CLAUDE.md

@@ -0,0 +1,50 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+This directory contains Docker deployment configuration for CodiMD (now HackMD), a collaborative markdown editor. **This is not a source code repository** - the actual CodiMD source code is maintained at https://github.com/hackmdio/codimd.
+
+## Architecture
+
+This deployment consists of two Docker services:
+
+- **database**: PostgreSQL 16 Alpine with security hardening, stores data at `./pgdata/`
+- **codimd**: The main application (hackmdio/hackmd:2.6.1) serving on port 3000, with uploads stored at `./upload-data/`
+
+All persistent data is stored in the current directory:
+- `./pgdata/` - PostgreSQL database files
+- `./upload-data/` - User uploaded files
+
+## Running the Application
+
+```bash
+# First time setup: copy and customize environment variables
+cp .env.example .env
+# Edit .env with strong passwords
+
+# Start all services
+docker-compose up -d
+
+# View logs
+docker-compose logs -f
+
+# Stop services
+docker-compose down
+```
+
+The application will be available at http://localhost:3000 (bound to 127.0.0.1 only)
+
+## Security Configuration
+
+The deployment includes several security improvements:
+
+- **Environment variables**: All secrets stored in `.env` file (git-ignored)
+- **PostgreSQL hardening**: Read-only container, no new privileges, tmpfs for temporary data
+- **Network isolation**: Services communicate via internal Docker network, database not exposed externally
+- **Health checks**: Both services have health checks for proper startup sequencing
+- **Local-only binding**: CodiMD binds to 127.0.0.1, not accessible from external network
+- **Session secret**: Auto-generated random secret for session encryption
+
+**Important**: Change the default passwords in `.env` before production use.

README.md

@@ -0,0 +1 @@
+https://github.com/hackmdio/codimd

docker-compose.yml

@@ -0,0 +1,62 @@
+services:
+  database:
+    image: postgres:16-alpine
+    container_name: codimd-postgres
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+      # PostgreSQL security settings
+      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
+    volumes:
+      - ./pgdata:/var/lib/postgresql/data
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - codimd-network
+    # Security: restrict to internal network only
+    ports: []
+    # Additional security options
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /var/run/postgresql
+
+  codimd:
+    image: hackmdio/hackmd:2.6.1
+    container_name: codimd-app
+    environment:
+      - CMD_DB_URL=${CMD_DB_URL}
+      - CMD_USECDN=false
+      - CMD_SESSION_SECRET=${CMD_SESSION_SECRET}
+      - CMD_SESSION_LIFETIME=1209600000
+      - CMD_PORT=3000
+    depends_on:
+      database:
+        condition: service_healthy
+    ports:
+      - "127.0.0.1:3000:3000"
+    volumes:
+      - ./upload-data:/home/hackmd/app/public/uploads
+    restart: always
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    networks:
+      - codimd-network
+    security_opt:
+      - no-new-privileges:true
+
+networks:
+  codimd-network:
+    driver: bridge
+    internal: false