update with latest build versions, includes custom build for postgres and migrating from v16 to v18

build/bookwyrm/bookwyrm-web/Dockerfile

@@ -3,6 +3,9 @@
 
 FROM bookwyrm-base AS bookwyrm-web
 
+LABEL org.opencontainers.image.title="BookWyrm Web" \
+      org.opencontainers.image.description="BookWyrm web server with Nginx and Gunicorn"
+
 # Switch to root for system package installation
 USER root
 
@@ -10,12 +13,12 @@ USER root
 RUN apt-get update && apt-get install -y --no-install-recommends \
     nginx-light \
     supervisor \
-    && rm -rf /var/lib/apt/lists/* \
+    && apt-get autoremove -y \
     && apt-get clean \
-    && apt-get autoremove -y
+    && rm -rf /var/lib/apt/lists/*
 
-# Install Gunicorn in virtual environment
-RUN /opt/venv/bin/pip install --no-cache-dir gunicorn
+# Install Gunicorn in virtual environment (pinned for reproducible builds)
+RUN /opt/venv/bin/pip install --no-cache-dir 'gunicorn>=23.0.0,<24.0.0'
 
 # Copy configuration files
 COPY nginx.conf /etc/nginx/nginx.conf
@@ -43,8 +46,5 @@ EXPOSE 80
 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
     CMD curl -f http://localhost:80/health/ || curl -f http://localhost:80/ || exit 1
 
-# Run as root to manage nginx and gunicorn via supervisor
-USER root
-
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

build/bookwyrm/bookwyrm-web/nginx.conf

@@ -77,6 +77,12 @@ http {
             add_header Content-Type text/plain;
         }
 
+        # Static files served via S3/CDN (bm.keyboardvagabond.com)
+        # No local static file serving needed when USE_S3=true
+        
+        # Images also served via S3/CDN  
+        # No local image serving needed when USE_S3=true
+
         # ActivityPub and federation endpoints
         location ~ ^/(inbox|user/.*/inbox|api|\.well-known) {
             proxy_pass http://127.0.0.1:8000;