From 3034d76682f9af0d342c1a4328ec7a01e1b804a6 Mon Sep 17 00:00:00 2001
From: Andrea <andrea@faerro.it>
Date: Sat, 26 Sep 2026 14:00:47 +0200
Subject: [PATCH] Update Dockerfile and docker-compose.yml to use port 80; add
 publish script for image management

---
 Dockerfile               |  4 ++--
 README.md                | 14 +++++++++++++-
 docker-compose.yml       |  4 ++--
 scripts/publish-image.sh | 30 ++++++++++++++++++++++++++++++
 4 files changed, 47 insertions(+), 5 deletions(-)
 create mode 100755 scripts/publish-image.sh

diff --git a/Dockerfile b/Dockerfile
index f2345dd..4c3881e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -7,5 +7,5 @@ COPY app ./app
 COPY frontend ./frontend
 
 ENV DATA_DIR=/data
-EXPOSE 8000
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
\ No newline at end of file
+EXPOSE 80
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "80"]
\ No newline at end of file
diff --git a/README.md b/README.md
index e8775e5..7c61224 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,19 @@ A self-hosted voice-note inbox for an iPhone-installed web app. Recordings are s
 docker compose up --build
 ```
 
-Open `http://localhost:8000` for a desktop smoke test. For iPhone use, serve the app over HTTPS through your VPN/reverse proxy. iOS only grants microphone access in a secure context. Keep the service reachable only through your VPN and firewall; this first version has no login layer.
+## Releases
+
+Git tags are the source of truth for release versions. From the repository root, create a semantic version tag on the commit to release, then run the publish script:
+
+```sh
+git tag 0.0.2
+docker login gitea.faerro.it
+./scripts/publish-image.sh
+```
+
+The script requires Docker and Git, and publishes both the versioned image (for example, `gitea.faerro.it/andrea/faerro-kb:0.0.2`) and `latest`. Tags may be plain versions or prefixed with `v`. Authenticate with a Gitea account or token that can publish packages before running the script.
+
+Open `http://localhost` for a desktop smoke test. Set `HTTP_PORT` to publish the app on a different host port (for example, `HTTP_PORT=8000 docker compose up`). For iPhone use, serve the app over HTTPS through your VPN/reverse proxy. iOS only grants microphone access in a secure context. Keep the service reachable only through your VPN and firewall; this first version has no login layer.
 
 In Safari on iPhone, open the HTTPS address and use **Share > Add to Home Screen**. Sign in to the VPN before opening the app if the server is only reachable there.
 
diff --git a/docker-compose.yml b/docker-compose.yml
index b71d6d9..17f188d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,8 @@
 services:
   voice-kb:
-    build: .
+    image: gitea.faerro.it/andrea/faerro-kb:0.0.1
     ports:
-      - "8000:8000"
+      - "${HTTP_PORT:-80}:80"
     environment:
       DATA_DIR: /data
       WHISPER_SERVER_URL: ${WHISPER_SERVER_URL:-}
diff --git a/scripts/publish-image.sh b/scripts/publish-image.sh
new file mode 100755
index 0000000..1b61419
--- /dev/null
+++ b/scripts/publish-image.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+image="gitea.faerro.it/andrea/faerro-kb"
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "Docker is required to build and publish the image." >&2
+  exit 1
+fi
+
+if ! command -v git >/dev/null 2>&1; then
+  echo "Git is required to determine the release version." >&2
+  exit 1
+fi
+
+tag="$(git -C "$repo_root" describe --tags --exact-match HEAD 2>/dev/null || true)"
+version="${tag#v}"
+
+if [[ ! "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+  echo "The checked-out commit must have a SemVer tag (for example, 0.0.2 or v0.0.2)." >&2
+  exit 1
+fi
+
+cd "$repo_root"
+docker build --tag "$image:$version" --tag "$image:latest" .
+docker push "$image:$version"
+docker push "$image:latest"
+
+echo "Published $image:$version and $image:latest"
\ No newline at end of file