diff --git a/wiki/decisions/container-deployment.md b/wiki/decisions/container-deployment.md
index 5a8b3ca..94c3562 100644
--- a/wiki/decisions/container-deployment.md
+++ b/wiki/decisions/container-deployment.md
@@ -72,6 +72,21 @@ The **desktop** app stays on its own tag-only `release.yml` (Tauri installers),
   THEN run `python -c "from fast_alpr import ALPR; ALPR()"` so weights land in `/home/vision/.cache`
   — exactly where the runtime reads. Verify the boot log shows NO "Downloading …onnx".
 
+## Web access — relative API + Caddy proxy (2026-06-23)
+
+- **The server-image SPA uses a RELATIVE `/api` base** (no baked origin), so the UI works loaded
+  from any hostname/IP. The Dockerfile empties `VITE_API_BASE` via `apps/web/.env.production.local`
+  before the web build — because Vite auto-loads `apps/web/.env.production`, which sets
+  `VITE_API_BASE=http://127.0.0.1:3000` for the **Tauri desktop** build only. Without the override
+  the browser bundle baked `127.0.0.1:3000` and failed Same-Origin Policy from any other host. **Do
+  NOT bake the domain via a build var** — relative means naming is controlled by hosts/DNS at deploy,
+  never a rebuild.
+- **A Caddy reverse proxy** (prod override) publishes `:80` → `server:3000` (server is `expose`-only,
+  internal); `/api/ws` upgrades pass through. `Caddyfile` binds `:80` so it matches ANY host — booth
+  IP, localhost, or `parksystems.msai.al` (pointed at the booth IP via hosts/DNS on-site). TLS later:
+  swap `:80` for the real hostname + uncomment Caddy `:443` → auto-HTTPS.
+- `WS_ALLOWED_ORIGINS` (env) must list any REMOTE origin admins use (same-origin always passes).
+
 ## Invariants (must hold)
 
 - **Never bake the live DB.** `.dockerignore` excludes `**/parking.sqlite*` (incl. `-wal`/`-shm`/