The production image for this site has two stages. Node runs the content checks, Astro build, and Pagefind index. Nginx receives only the generated dist/ directory in the runtime stage.
That split keeps build tools and source files out of the serving container. It also makes the runtime contract easy to describe: Nginx listens on port 80 and serves files.
Private source, narrow access
Coolify pulls the repository through a read-only deploy key. The private key stays in Coolify, while GitHub stores only the public key. A push to main can be deployed without putting a token in the repository.
The repository contains the Dockerfile and the build configuration. Runtime secrets are not needed for this static site, so there is no environment file to copy into the image.
Verify the thing people use
A deployment is not finished when the build log says it completed. The useful checks are the normalized domain, the home page, a content route, the RSS feed, the sitemap, and the browser search interface.
For a static site, those checks are short. That is one of the advantages of keeping the request path simple.