update security

docs/deployment.md

@@ -20,14 +20,27 @@ into the Gitea container, preventing them from overriding its internal listener.
 ## 1. VM and network
 
 Install Docker Engine with Compose v2. Permit the selected HTTP and HTTPS ports
-and forward public TCP 80 and 443 from the datacenter edge to them. The
-Create public DNS A/AAAA records for both application names before requesting
-the certificate.
+and forward public TCP 80 and 443 from the datacenter edge to them. Create
+public DNS A/AAAA records for both application names before requesting the
+certificate.
 
 Public port 80 must reach the container's port 80 for HTTP-01 certificate
 renewal. For example, if `HTTP_PORT=8080`, the edge must forward public port 80
 to VM port 8080. If IPv6 is published, it must reach this same VM.
 
+The company firewall should provide volumetric DDoS protection and permit only
+the required forwarded ports. Nginx supplies the application-edge controls:
+unknown HTTP hostnames are dropped, unknown TLS SNI names are rejected,
+TLS is restricted to 1.2/1.3, session tickets and version disclosure are
+disabled, broker requests and per-address connections are limited, slow-client
+timeouts are bounded, Gitea login bursts are throttled, and HSTS plus browser
+security headers are returned. Container PID ceilings and Docker log rotation
+reduce the impact of local resource exhaustion.
+Nginx also runs with a read-only container filesystem and narrowly scoped
+temporary filesystems. The broker trusts proxy headers because Nginx is its
+only production ingress; Nginx replaces rather than appends client-supplied
+forwarding headers.
+
 ## 2. Install the repository
 
 ```sh