Host on AWS Lightsail as boards.watersmedia.org

Replace the planned Synology deploy with one Lightsail box: Caddy in front of the
app for automatic HTTPS (deploy/aws/docker-compose.yml, Caddyfile), a deploy
script that rsyncs server/ and rebuilds in place without touching data/ or .env,
and a Gitea workflow that runs the same script from the nas runner over SSH.
README documents the box, DNS, .env, deploys and restore. Allow both church
Google Workspace domains to sign in. Drop the NAS-only compose file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

server/.env.example

@@ -6,8 +6,9 @@ PORT=3100
 # See README.md › "Set up Google sign-in". Leave empty to disable Google sign-in.
 GOOGLE_CLIENT_ID=
 
-# Only Google accounts on these domains can sign in (comma-separated).
-ALLOWED_DOMAINS=waterschurch.org
+# Only Google accounts on these domains can sign in (comma-separated). Both church
+# domains are Google Workspace domains, so both are allowed by default.
+ALLOWED_DOMAINS=waterschurch.org,waters.church
 
 # These people are always admins (comma-separated). The very first person to sign in
 # also becomes an admin.

server/docker-compose.yml

@@ -1,14 +0,0 @@
-services:
-  boards:
-    build: .
-    image: waters-boards:latest
-    container_name: waters-boards
-    restart: unless-stopped
-    ports:
-      # Host port : container port. 3000 is the checklist app, so this uses 3100.
-      - "3100:3100"
-    env_file:
-      - .env
-    volumes:
-      # Database (boards.db), uploaded files and nightly backups.
-      - ./data:/app/data