feat: build headless theatre laboratory website

docs/deployment.md

@@ -1,15 +1,43 @@
 # Deployment
 
-Describe how this project is deployed.
+## Local environment
 
-Include:
+Copy `.env.example` to `.env`, replace the development placeholders, then run:
 
-- environments;
-- Docker/Compose usage;
-- required configuration;
-- secrets handling;
-- exposed ports;
-- volumes;
-- networks;
-- deployment commands;
-- rollback procedure.
+```bash
+cp .env.example .env
+docker compose up --build -d
+docker compose ps
+docker compose exec backend python manage.py seed_demo
+```
+
+The backend applies migrations and collects static files before starting Gunicorn.
+All services have health checks; wait for healthy status before opening the site.
+
+Compose exposes the Astro site on loopback port `4321` and Django/Wagtail on loopback
+port `8000`. PostgreSQL is available only on the Compose network. `postgres_data` and
+`media_data` are persistent named volumes.
+
+The stack uses explicit PostgreSQL 16.9, Python 3.12.12, and Node.js 22.20 image
+versions. Containers are not privileged and use `no-new-privileges`.
+
+Required runtime variables are `DATABASE_URL`, `DJANGO_SECRET_KEY`, `DJANGO_DEBUG`,
+`DJANGO_ALLOWED_HOSTS`, `WAGTAILADMIN_BASE_URL`, and `PUBLIC_CMS_API_URL`. PostgreSQL
+bootstrap variables are also documented in `.env.example`. Do not use the example
+credentials outside local development.
+
+`WAGTAILADMIN_BASE_URL` must be browser-reachable because it is used for media URLs.
+`PUBLIC_CMS_API_URL` must be reachable by Astro; within Compose it is
+`http://backend:8000`.
+
+## Production boundary
+
+The Compose stack is a local development deployment. A public environment still needs
+TLS termination, production static/media serving, restricted admin access, managed
+secrets, off-host backups, monitoring, and an explicit domain/allowed-host policy.
+
+## Rollback
+
+Revert the application commit and rebuild images. Keep the database and media volumes
+unless content deletion is intentional. Schema rollback must be evaluated per Django
+migration; take coordinated database and media backups first.