prod setup

README.md

@@ -52,6 +52,22 @@ listening on http://localhost:5150
 
 You can check your [configuration](config/development.yaml) to pick either frontend setup or server-side rendered template, and activate the relevant configuration sections.
 
+## Production Podman Deploy
+
+Create the production environment file:
+
+```sh
+cp .env.production.example .env.production
+```
+
+Edit `.env.production` and set real secrets for `POSTGRES_PASSWORD`, `JWT_SECRET`, `OAUTH_PRIVATE_KEY`, and the OAuth client values. Then start the production stack:
+
+```sh
+make up
+```
+
+The production Podman stack runs Caddy, the Loco app, and Postgres. Caddy publishes ports `80` and `443`; the app port `5150` stays private on the container network. HTTP requests on port `80` are redirected to HTTPS on port `443`.
+
 
 ## Getting help