Production (Dokploy/Docker) was sending no security headers at all -
static/_headers and wrangler.toml were Cloudflare Pages/Workers
config that static-web-server never reads. Added sws.toml with the
same CSP/security headers and the two redirects from _redirects,
wired into the Dockerfile. Removed wrangler.toml, static/_headers,
static/_redirects, the wrangler devDependency/deploy script, and
related .gitignore/.dockerignore entries since Cloudflare deploy is
no longer used.
Also fixed a console error in theme.js where the Utterances
postMessage call could fire before the comments iframe navigated to
utteranc.es.
Adds a multi-stage Dockerfile (Node for llms.txt generation, the
official Zola image to build, static-web-server to serve) for
deploying via Dokploy/Docker instead of Cloudflare Pages. This is an
additional path, not a replacement - wrangler.toml and the Cloudflare
build.sh remain in place as an option.
Also bumps build.sh's pinned ZOLA_VERSION from 0.22.1 to 0.23.1: the
prior commit migrated every template to Tera v2 syntax (components,
spread operator, native slicing), which 0.22.1 can't parse - confirmed
by a live Cloudflare build failure on this branch. Keeping build.sh
and the Dockerfile on the same Zola version avoids maintaining two
template dialects across the two deploy paths.
Verified: `docker build` succeeds, the container serves the homepage,
a post, the youtube embed, and a proper 404; `build.sh` also runs
clean standalone (simulating the Cloudflare build) and produces a
fully populated public/.
andwati