podman -> docker

README.md

@@ -52,7 +52,7 @@ listening on http://localhost:5150
 
 You can check your [configuration](config/development.yaml) to pick either frontend setup or server-side rendered template, and activate the relevant configuration sections.
 
-## Production Podman Deploy
+## Production Docker Deploy
 
 Create the production environment file:
 
@@ -60,13 +60,22 @@ Create the production environment file:
 cp .env.production.example .env.production
 ```
 
-Edit `.env.production` and set real secrets for `POSTGRES_PASSWORD`, `JWT_SECRET`, `OAUTH_PRIVATE_KEY`, and the OAuth client values. Then start the production stack:
+Edit `.env.production` and set real secrets for `POSTGRES_PASSWORD`, `JWT_SECRET`, `OAUTH_PRIVATE_KEY`, and the OAuth client values. Create the shared network once (the central Caddy joins it too):
+
+```sh
+docker network create kompress_eshop-net
+```
+
+Then start the production stack:
 
 ```sh
 make up
 ```
 
-The production Podman stack runs Caddy, the Loco app, and Postgres. Caddy publishes ports `80` and `443`; the app port `5150` stays private on the container network. HTTP requests on port `80` are redirected to HTTPS on port `443`.
+The stack runs the Loco app + Postgres only — TLS/routing is handled by the
+central Caddy (`docker-compose.caddy.yml`), which shares the external
+`kompress_eshop-net` network and reaches the app as `kompress:5150` via the
+imported `Caddyfile`. The app port `5150` is never published to the host.
 
 
 ## Getting help