enable dev|prod envs with simpler env vars system

docker/Dockerfile

@@ -1,7 +1,7 @@
 # ── Build stage ──────────────────────────────────────────
 FROM node:22-alpine AS builder
-ARG PUBLIC_PB_URL=/pb
-ENV PUBLIC_PB_URL=$PUBLIC_PB_URL
+# Browser → PB goes through nginx at /pb (same origin) — fixed for docker.
+# ENV PUBLIC_PB_URL=/pb
 RUN corepack enable
 WORKDIR /app
 COPY . .
@@ -11,9 +11,9 @@ RUN pnpm --filter proxy build
 
 # ── Runtime stage ────────────────────────────────────────
 FROM node:22-alpine
-ARG PUBLIC_PB_URL=/pb
-ENV PUBLIC_PB_URL=$PUBLIC_PB_URL
-ENV PB_ENDPOINT=http://127.0.0.1:8090
+# Browser → PB goes through nginx at /pb (same origin). PB_ENDPOINT (server →
+# PB) is a loopback constant in the app code, not an env var.
+# ENV PUBLIC_PB_URL=/pb
 RUN corepack enable && apk add --no-cache nginx wget unzip ca-certificates
 WORKDIR /app
 COPY --from=builder /app/frontend/build ./frontend/build
@@ -27,7 +27,10 @@ RUN wget -qO /tmp/pb.zip https://github.com/pocketbase/pocketbase/releases/downl
     && unzip -o /tmp/pb.zip -d /usr/local/bin/ \
     && rm /tmp/pb.zip
 RUN chmod +x /entrypoint.sh /usr/local/bin/pocketbase
-ENV FRONTEND_PORT=2080
-ENV PROXY_PORT=3456
-EXPOSE 3001 8090
+# ENV FRONTEND_PORT=2080
+# ENV PROXY_PORT=3456
+# Public entrypoint. The host port is chosen at deploy time via compose PORT;
+# EXPOSE here is documentation only (nginx listens on 3001). PB (8090) stays
+# internal — never published from the image.
+EXPOSE 3000 8090
 CMD ["/entrypoint.sh"]

docker/entrypoint.sh

@@ -1,7 +1,8 @@
 #!/bin/sh
 set -e
 
-PB_DATA=${PB_DATA_DIR:-/app/pb_data}
+# PocketBase data lives on the mounted volume (compose maps ./pb_data → /app/pb_data).
+PB_DATA=/app/pb_data
 
 # Seed a platform superuser from env (idempotent — no-op if it already exists).
 # If PB_EMAIL/PB_PASSWORD aren't set, skip and rely on manual web setup.
@@ -24,7 +25,9 @@ for i in $(seq 1 30); do
 done
 
 # Start the app (frontend + proxy). The proxy auto-runs schema migration.
-PORT=${FRONTEND_PORT:-2080} node /app/frontend/build/index.js &
-PROXY_PORT=${PROXY_PORT:-3456} node /app/proxy/dist/index.js &
+# FRONTEND_PORT/PROXY_PORT are set via ENV in the Dockerfile; adapter-node
+# reads PORT, the proxy reads PROXY_PORT.
+node /app/frontend/build/index.js &
+node /app/proxy/dist/index.js &
 
 nginx -g 'daemon off;'

docker/nginx.conf

@@ -1,9 +1,9 @@
 server {
-	listen 3001;
+	listen 80;
 	server_name _;
 
 	location / {
-		proxy_pass http://127.0.0.1:2080;
+		proxy_pass http://127.0.0.1:3000;
 		proxy_http_version 1.1;
 		proxy_set_header Upgrade $http_upgrade;
 		proxy_set_header Connection 'upgrade';