Skip to content

Deploy your Denote documentation site to production

Deployment

Denote is a standard Fresh app. It can be deployed anywhere that runs Deno or Docker.

Build for Production

Create a production build:

bash
deno task build

This generates an optimized build in the _fresh/ directory. To preview it locally:

bash
deno task start

Your site will be available at http://localhost:8000.

Deno Deploy

Deno Deploy is the fastest way to deploy. Since Denote is a Fresh app, follow the standard Fresh deployment guide.

The quickest option is connecting your GitHub repository for automatic deploys on every push — no CLI needed.

Manual Deploy

If you prefer the CLI:

bash
deno install -gArf jsr:@deno/deployctl

deno task build
deployctl deploy --project=<your-project> _fresh/server.js

Docker

Every Denote project includes a production-ready Dockerfile.

Build and Run

bash
docker build -t my-docs .
docker run -p 8000:8000 my-docs

Your site will be available at http://localhost:8000.

Container Platforms

The Docker image works on any container platform — Railway, Fly.io, Render, Coolify, Kubernetes, or any VPS with Docker installed.

Security Headers

Denote automatically sets security headers on every response — no reverse proxy configuration needed:

HeaderValue
Strict-Transport-Securitymax-age=63072000; includeSubDomains; preload
X-Content-Type-Optionsnosniff
X-Frame-OptionsDENY
Referrer-Policystrict-origin-when-cross-origin
Content-Security-PolicyAuto-configured policy
Permissions-PolicyRestricts browser features (camera, mic, etc.)

These headers are always active in both development and production. Hashed static assets (files matching /_fresh/ or .[hash].(js|css|...)) also receive Cache-Control: public, max-age=31536000, immutable for aggressive caching.

If you run Denote behind a reverse proxy, the proxy's headers will merge with these. No extra proxy configuration is needed for basic security compliance.

Next Steps