docs: REMOVE ghcr note as it has been removedfrom GH

Dockerfile

@@ -1,24 +1,38 @@
 # syntax=docker/dockerfile:1.7
 
 # ============================================================================
-# Build stage: install Python dependencies into a dedicated prefix
+# Build stage: Debian 12's Python (paths/libs match the distroless runtime)
 # ============================================================================
-FROM python:3.11-slim-bookworm AS builder
+# We deliberately do NOT use python:3.11-slim-bookworm here — that image is
+# Python.org's, which installs Python to /usr/local with an RPATH pointing
+# back into /usr/local/lib. Distroless has libpython under /usr/lib, so the
+# RPATH would break. Debian's apt-installed python3 lives at the same paths
+# as distroless's, so symlinks and libpython all resolve correctly.
+FROM debian:12-slim AS builder
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1
 
-# Install runtime deps into /install. --target keeps everything in one tree
-# so we can copy it cleanly to a distroless image without venv/shebang issues.
-RUN pip install --target=/install \
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+         python3 python3-pip python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+# Default (symlink) venv. /opt/venv/bin/python ends up as a symlink to
+# /usr/bin/python3, which distroless also provides.
+RUN python3 -m venv /opt/venv
+ENV PATH=/opt/venv/bin:$PATH
+
+# Install runtime deps into the venv's site-packages
+RUN pip install \
       fastapi==0.115.* \
       "uvicorn[standard]==0.30.*" \
       redis==5.0.*
 
-# Pre-compile bytecode for faster cold start under a read-only rootfs
-RUN python -m compileall -q /install
+# Pre-compile bytecode for faster cold start on a read-only rootfs
+RUN python3 -m compileall -q /opt/venv
 
 # ============================================================================
 # Runtime stage: distroless Python 3.11, non-root, no shell
@@ -29,21 +43,19 @@ RUN python -m compileall -q /install
 FROM gcr.io/distroless/python3-debian12:nonroot
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PYTHONPATH=/app/lib
+    PYTHONUNBUFFERED=1
 
 WORKDIR /app
 
-# Site-packages first (rarely changes → maximises layer cache)
-COPY --from=builder --chown=nonroot:nonroot /install /app/lib
+# Venv ships its site-packages; its bin/python symlink resolves against
+# distroless's /usr/bin/python3 and Debian's libpython at /usr/lib/...
+COPY --from=builder --chown=nonroot:nonroot /opt/venv /opt/venv
 
-# Application source (changes most often → its own layer)
+# Application source (its own layer so source-only changes don't bust dep cache)
 COPY --chown=nonroot:nonroot app.py favicon.ico /app/
 
 USER nonroot
 EXPOSE 8000
 
-# Module form (-m uvicorn) sidesteps broken shebangs in /app/lib/bin/uvicorn
-# (those were generated against the builder's Python path, not distroless's).
-ENTRYPOINT ["/usr/bin/python3", "-m", "uvicorn"]
+ENTRYPOINT ["/opt/venv/bin/python", "-m", "uvicorn"]
 CMD ["app:app", "--host", "0.0.0.0", "--port", "8000"]

README.md

@@ -1,6 +1,6 @@
 # Aukpad
 
-Simple **live collaboration notepad** with websockets and FastAPI.
+Simple **temporary live collaboration notepad** with websockets and FastAPI — pads expire automatically after a configurable retention period.
 
 [Issue tracker](https://git.uphillsecurity.com/cf7/aukpad/issues) | `Libera Chat #aukpad` 
 
@@ -16,23 +16,34 @@ The goal is to keep it simple! For feature-rich solutions please check out [hedg
 ## Features
 
 **Use cases:**
-- shared notepad on multiple machines
+- shared notepad across multiple machines
 - collaboration on the same notepage with multiple people (notes, config, etc)
-- config changes in aukpad > `curl -o app.conf https://aukpad.com/{pad_id}/raw` > change config in aukpad > repeat `curl` command
+- piping configs: `curl -o app.conf https://aukpad.com/{pad_id}/raw` → edit in aukpad → repeat
 
-**Available**:
-- live collab notepad
-- line numbers
-- custom path `{pad_id}` for more privacy (1–64 chars, `[a-zA-Z0-9_-]`)
-- optional caching with valkey/redis
-- pad creation with HTTP post requests with curl (see *Usage*)
-- `{pad_id}/raw` HTTP endpoint 
-- optional password protection (HTTP endpoint accessible with GET /{pad_id}/raw?pw=mysecurepasswordhunter2)
+**Editor:**
+- real-time WebSocket collaboration with cursor preservation across remote edits
+- per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI
+- line numbers; Tab inserts 4 spaces
+- dark / light mode (auto-detects system preference, manual toggle)
+- copy-to-clipboard and "new pad" buttons, live peer count in the header
 
-**Ideas**:
+**Endpoints:**
+- custom pad path `{pad_id}` (1–64 chars, `[a-zA-Z0-9_-]`); auto-generated IDs are 8-char `[a-z0-9]`
+- `POST /` — create a pad from request body (curl-friendly, see *Usage*)
+- `GET /{pad_id}/raw` — raw text (auth via `?pw=…` for protected pads)
+- `GET /system/info` — instance configuration page
+- WebSocket `/ws/{pad_id}` — live collaboration
+
+**Deployment:**
+- optional Valkey/Redis cache for cross-restart persistence
+- configurable text-size, connection, room, and retention limits
+- per-IP rate limiting (pad creation + failed password attempts), reverse-proxy aware
+- distroless, non-root, read-only-rootfs container image
+
+**Ideas:**
 [Check out the open feature requests](https://git.uphillsecurity.com/cf7/aukpad/issues?q=&type=all&sort=&state=open&labels=12&milestone=0&project=0&assignee=0&poster=0&archived=false)
 
-**Not planned**:
+**Not planned:**
 - accounts / RBAC
 
 ---
@@ -61,10 +72,6 @@ ip -br a | curl -X POST https://aukpad.com --data-binary @-   # command output
 
 Open `127.0.0.1:8000`
 
-Alternative, use Github Container Repository:
-
-`ghcr.io/caffeinefueled1/aukpad:latest`
-
 **Adv. example with Podman**
 
 ```bash
@@ -93,7 +100,6 @@ podman run -d --name aukpad-app \
     --tmpfs /tmp \
     --security-opt no-new-privileges:true \
     --cap-drop ALL \
-    --user 1000:1000 \
     -e USE_VALKEY=true \
     -e VALKEY_URL=redis://:xeZNopyIeMMncqDFPHtJQwMwIathgMWo@localhost:6379 \
     -e MAX_TEXT_SIZE=5 \
@@ -130,12 +136,6 @@ For security concerns or reports, please contact via `hello a t uphillsecurity d
 
 ---
 
-## Notes
-
-- [Github Mirror available](https://github.com/CaffeineFueled1/aukpad)
-
----
-
 ## License
 
 **Apache License**

app.py

@@ -68,8 +68,8 @@ def init_valkey():
             redis_client = redis.from_url(VALKEY_URL, decode_responses=True)
             redis_client.ping()  # Test connection
             print(f"Valkey/Redis connected: {VALKEY_URL}")
-        except ImportError:
-            print("Warning: redis package not installed, falling back to memory-only storage")
+        except ImportError as e:
+            print(f"Warning: redis package import failed ({e}), falling back to memory-only storage")
             redis_client = None
         except Exception as e:
             print(f"Warning: Failed to connect to Valkey/Redis: {e}")
@@ -590,6 +590,18 @@ def get_system_info():
   <div class="info-section">
     <h2>Instance</h2>
     <p>{DESCRIPTION}</p>
+    <p>Simple <strong>temporary live collaboration notepad</strong> with websockets and FastAPI — pads expire automatically after a configurable retention period.</p>
+  </div>
+
+  <div class="info-section">
+    <h2>Features</h2>
+    <ul>
+      <li>real-time WebSocket collaboration with cursor preservation across remote edits</li>
+      <li>per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI</li>
+      <li>line numbers; Tab inserts 4 spaces</li>
+      <li>dark / light mode (auto-detects system preference, manual toggle)</li>
+      <li>copy-to-clipboard and "new pad" buttons, live peer count in the header</li>
+    </ul>
   </div>
 
   <div class="info-section">