Fix noVNC WebSocket routing

DOKPLOY_DEPLOY.md

@@ -17,7 +17,9 @@ The bot has been updated to support automated login using environment variables.
         *   `OPENROUTER_API_KEY`: Your OpenRouter API key.
         *   `REDDIT_USERNAME`: Your Reddit username.
         *   `REDDIT_PASSWORD`: Your Reddit password.
-        *   `BROWSER_HEADLESS`: `true` (Important for server environments).
+        *   `BROWSER_HEADLESS`: `false` (required for interactive noVNC login).
+        *   `VNC_PASSWORD`: A strong password for the interactive VNC session.
+        *   `NOVNC_PUBLIC_URL`: `http://<dokploy-host>:16080`.
 
 3.  **Volumes (Persistence)**:
     *   The `docker-compose.yml` is already configured to mount a `./data` volume.
@@ -28,6 +30,19 @@ The bot has been updated to support automated login using environment variables.
     *   Push your code to your Git repository connected to Dokploy.
     *   Click "Deploy".
 
+## noVNC networking
+
+The Compose configuration publishes noVNC directly on host port `16080`.
+Do not route it through a Dokploy/Traefik domain: the upstream proxy strips
+the WebSocket Upgrade request that noVNC requires, producing `rfb.js:688` with
+WebSocket code `1011` and “Failed to connect to downstream server”.
+
+Set `NOVNC_PUBLIC_URL` to `http://<dokploy-host>:16080`, then open that URL in
+a separate tab from the dashboard. If the dashboard itself is HTTPS, browsers
+will not embed this HTTP endpoint in its iframe; the separate-tab link is the
+intended route. Restrict inbound TCP `16080` at the Dokploy host firewall to
+your own IP or VPN subnet.
+
 ## How it works
 
 1.  On the first run, the bot will see the `data/browser-session` folder is empty/invalid.