From 9784bb192cb764f4f4b433883f407bc7ae0cca7b Mon Sep 17 00:00:00 2001
From: BaaRai <130491490+BaaRai@users.noreply.github.com>
Date: Fri, 6 Nov 2026 14:31:52 +0100
Subject: [PATCH] chore: keep secrets out of the Docker build context; drop
 stale README step

The build stage of the Dockerfile runs `COPY . .`, so anything left in the
checkout root is sent to the builder and copied into the build stage. Exclude
the local secrets and backups that the install and backup scripts create
there: .env, config.json, jwt.key and backups/. keys/ was already excluded.

The Docker Compose (manual) section of the README still told users to build
the single binary before `docker compose up -d --build`. Since the
multi-stage Dockerfile builds the frontend and the Go binary itself, that
step is no longer needed; remove it.
---
 .dockerignore | 4 ++++
 README.md     | 1 -
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.dockerignore b/.dockerignore
index 3c378fc..2a5730d 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -6,6 +6,10 @@ server/webui/dist
 /artex
 data
 keys
+backups
+.env
+config.json
+jwt.key
 *.db
 transcripts
 bench/kv
diff --git a/README.md b/README.md
index 5bdbc0b..da3f6c2 100644
--- a/README.md
+++ b/README.md
@@ -100,7 +100,6 @@ The web UI is published on `127.0.0.1` by default. To reach it from another mach
 git clone https://github.com/BaaRai/ARTEX.git
 cd ARTEX
 cp .env.example .env          # set POSTGRES_PASSWORD, optionally ANTHROPIC_API_KEY
-# build the single binary first (frontend, then go build -tags embedui), see the Dockerfile header
 docker compose up -d --build  # builds artex from this checkout + starts postgres
 # → http://localhost:8787
 ```