# CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

## Overview

This directory contains Docker deployment configuration for CodiMD (now HackMD), a collaborative markdown editor. **This is not a source code repository** - the actual CodiMD source code is maintained at https://github.com/hackmdio/codimd.

## Architecture

This deployment consists of two Docker services:

- **database**: PostgreSQL 16 Alpine with security hardening, stores data at `./pgdata/`
- **codimd**: The main application (hackmdio/hackmd:2.6.1) serving on port 3000, with uploads stored at `./upload-data/`

All persistent data is stored in the current directory:
- `./pgdata/` - PostgreSQL database files
- `./upload-data/` - User uploaded files

## Running the Application

```bash
# First time setup: copy and customize environment variables
cp .env.example .env
# Edit .env with strong passwords

# Start all services
docker-compose up -d

# View logs
docker-compose logs -f

# Stop services
docker-compose down
```

The application will be available at http://localhost:3000 (bound to 127.0.0.1 only)

## Security Configuration

The deployment includes several security improvements:

- **Environment variables**: All secrets stored in `.env` file (git-ignored)
- **PostgreSQL hardening**: Read-only container, no new privileges, tmpfs for temporary data
- **Network isolation**: Services communicate via internal Docker network, database not exposed externally
- **Health checks**: Both services have health checks for proper startup sequencing
- **Local-only binding**: CodiMD binds to 127.0.0.1, not accessible from external network
- **Session secret**: Auto-generated random secret for session encryption

**Important**: Change the default passwords in `.env` before production use.