jdsjkdjk

lean/README.md

@@ -61,13 +61,16 @@ The `BAKE_MATHLIB=false` image still ships the pinned elan toolchain, but not
 the project's `.lake`: the entrypoint notices a fresh volume and fills it once
 at first start — `lake update` fetches the sources pinned in
 `lake-manifest.json`, Mathlib's post-update hook downloads the matching
-precompiled cache, `lake build` writes the project's own module. Expect ~10
-minutes and a few hundred MB of download; restarts after that are instant,
-and **image rebuilds never touch Mathlib again** (the volume stays). The
-trade: the cache must survive on the host, first start needs network, and it
-redoes once if you recreate with a clean volume — hence the default staying
-`BAKE_MATHLIB=true`. The commented blocks in `docker-compose.yml` wire this
-up for the production stack.
+precompiled cache, `lake build` writes the project's own module. The manifest
+`lake update` resolved gets saved into the volume and re-applied at every
+start, so the packages in the volume and the manifest in the image never tell
+different stories (an unsynced pair would try to re-fetch Mathlib from GitHub
+at each session). Expect ~10 minutes and a few hundred MB of download;
+restarts after that are instant, and **image rebuilds never touch Mathlib
+again** (the volume stays). The trade: the cache must survive on the host,
+first start needs network, and it redoes once if you recreate with a clean
+volume — hence the default staying `BAKE_MATHLIB=true`. The commented blocks
+in `docker-compose.yml` wire this up for the production stack.
 
 ## The protocol the wiki's client speaks
 
@@ -138,7 +141,12 @@ browser will refuse the editor's `ws://` connection to an `http://` server
 (mixed content). Serve the
 Lean server over HTTPS — either its own `SSL_CRT_FILE`/`SSL_KEY_FILE`, or a
 reverse proxy in front (websocket upgrade on the same path) — and point
-`NUXT_PUBLIC_LEAN_URL` at the `https://` address.
+`NUXT_PUBLIC_LEAN_URL` at the `https://` address. The production stack does
+the latter: nginx serves it at `https://mathew.aranroig.com/api/lean` and
+proxies to `lean:8080`; the compose service publishes 8080 on loopback only
+(dev's frontend), so the public way in is that one address. Note that the
+bundled classic client expects to sit at the server root — under `/api/lean`
+its assets resolve against the wiki and 404; the wiki's own editor is fine.
 
 ## Updating