chore: makefile + setup

README.md

@@ -7,21 +7,38 @@ API is there so the Flutter app can be a second client without backend changes.
 
 ## Setup
 
-```bash
-uv sync
-uv run python manage.py migrate
-uv run python manage.py createsuperuser   # the only way to make an account: there is no registration
-uv run python manage.py runserver
-```
-
-Then open <http://127.0.0.1:8000/> — it redirects to the Today page.
-
-To reach it from your phone on the same network:
+`make help` lists everything. On a fresh box:
 
 ```bash
-DJANGO_CSRF_TRUSTED_ORIGINS=http://192.168.1.x:8000 uv run python manage.py runserver 0.0.0.0:8000
+make install     # uv sync, write .env (fresh SECRET_KEY + VAPID keys), migrate, collectstatic
+make superuser   # the only way to make an account: there is no registration
+make service     # install + start the systemd unit (gunicorn on 127.0.0.1:8000) — needs sudo
+make cron        # reminder job, every 10 minutes
 ```
 
+Review `DJANGO_ALLOWED_HOSTS` and `DJANGO_CSRF_TRUSTED_ORIGINS` in `.env` before
+going live, and `make restart` after any change to it — the settings are read at
+startup, so an edited `.env` does nothing until the service restarts.
+
+Put a TLS-terminating proxy (Caddy, nginx, a Cloudflare tunnel) in front of
+port 8000; the app itself is HTTP-only and bound to localhost. HTTPS is not
+optional if you want reminders — see below.
+
+Day to day:
+
+```bash
+make run         # development server on :8000
+make test
+make lint        # or: make format
+make deploy      # sync + migrate + collectstatic + restart
+make logs        # journalctl -u osiris -f
+make cron-test   # what the reminder job would send right now
+```
+
+`.env` is sourced by a shell wrapper, so its values must stay unquoted and
+shell-safe. `make env` generates the secret from a URL-safe alphabet for exactly
+that reason — a hand-written key containing `)` or `$` would break the cron job.
+
 ## Using it
 
 1. **Admin → Medications → Add**: create a medication and give it one row per