Harden legacy production artifacts and Compose env-file guidance

README.md

@@ -343,6 +343,7 @@ docker compose -f docker-compose.yml -f compose.prod.yaml --env-file .env.produc
 ```
 
 `compose.prod.yaml` is an override file for `docker-compose.yml` (not a standalone compose file).
+`--env-file .env.production` is required so Compose can interpolate `${VAR}` values in the compose model (while `env_file:` only affects container runtime environment).
 
 > Security note: define production credentials explicitly via `.env.production` (or Docker secrets) before startup.
 

compose_prod_full.yml

@@ -2,7 +2,7 @@ services:
   app:
     build:
       context: .
-      dockerfile: Dockerfile.prod
+      dockerfile: Dockerfile
     image: elahe-app:production
     container_name: elahe-app
     restart: unless-stopped
@@ -63,6 +63,12 @@ services:
       - "80:80"
       - "443:443"
       - "443:443/udp"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
 
 volumes:
   pgdata:
+  caddy_data:
+  caddy_config:

install-v2.6.sh

@@ -1,5 +1,9 @@
 #!/bin/bash
-# Elahe Messenger Installer v1.0 (hotfix)
+# LEGACY INSTALLER (DEPRECATED)
+# This script is retained for historical reference only.
+# Use the hardened installer instead:
+#   curl -fsSL https://raw.githubusercontent.com/ehsanking/ElaheMessenger/main/install.sh | ( [ "$(id -u)" -eq 0 ] && bash || sudo bash )
+# See docs/installer-verification-checklist.md for the supported workflow.
 # Aligns deployment with the current docker-compose.yml and production env validation.
 set -euo pipefail