crazy refactor

README.md

@@ -8,7 +8,7 @@ A simple single-instance Discord-style monolith in Rust using:
 ## What this includes
 
 - OIDC login flow (`/auth/login`, `/auth/callback`, `/auth/logout`)
-- Signed session cookie auth
+- HttpOnly session cookie auth
 - Channel voice chat over WebRTC (P2P mesh) with server WebSocket signaling
 - Guild invite codes (create + join)
 - Direct messages (DM) between users
@@ -41,6 +41,11 @@ For voice reliability on restrictive networks, configure TURN in `.env`:
 - `TURN_USERNAME`
 - `TURN_PASSWORD`
 
+For production deployments:
+- `APP_BASE_URL` must be your public app origin and should use `https`
+- `MEDIA_BASE_URL` should be a separate media origin for user uploads
+- uploads and soundboard require R2/object storage to be configured
+
 3. Run app:
 
 ```bash
@@ -55,7 +60,7 @@ Web UI is available at `http://localhost:${PORT}/`.
 ## Authentik setup notes
 
 Create an Authentik OAuth2/OIDC provider + application and set:
-- Redirect URI: `http://localhost:3000/auth/callback`
+- Redirect URI: `${APP_BASE_URL}/auth/callback`
 - Scopes including at least: `openid profile email`
 
 If you change `PORT`, update `OIDC_REDIRECT_URL` and this redirect URI to match.
@@ -91,6 +96,7 @@ For Authentik these are commonly under `/application/o/...` for the app slug.
 - `GET /channels/:channel_id/voice/ws` (WebSocket signaling)
 
 All endpoints except health and auth flow require the session cookie from successful login.
+Authenticated WebSocket connections (`/ws`, `/channels/:channel_id/voice/ws`) also use the same cookie session.
 
 ## Notes
 
@@ -98,6 +104,7 @@ This is intentionally minimal and monolithic (single process, single Postgres in
 Voice is implemented as browser-to-browser WebRTC audio with signaling in this server.
 For two users behind strict NAT/firewall, you may need TURN for reliable connectivity.
 The web UI remembers the last selected guild in browser local storage and auto-selects it on reload.
+User uploads are served from the configured media origin, not from `/static`.
 
 Mic filter modes in the UI:
 - `NSNet2 (Compat)`: always-on denoising mode (implemented using DeepFilterNet3 with lighter suppression preset)