Harden production Docker stack for MySQL, API proxy, and builds.

Keep MySQL internal-only with env-based credentials, proxy /api/backend through nginx with Docker DNS refresh, and support host SOCKS/HTTP proxy during image builds.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -1,20 +1,67 @@
-version: '3.8'
-
 services:
+  mysql:
+    # Host CPU lacks x86-64-v2 (no SSE4.2); MySQL 8.x official images crash with glibc fatal.
+    image: mysql:5.7
+    container_name: badi-pwa-mysql
+    restart: unless-stopped
+    env_file:
+      - .env.mysql
+    # Do NOT publish 3306 — public MySQL is a common ransomware target (RECOVER_YOUR_DATA).
+    # Backend reaches MySQL via the internal Docker network only.
+    volumes:
+      - badi_pwa_mysql_data:/var/lib/mysql
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h127.0.0.1 -uroot -p$$MYSQL_ROOT_PASSWORD || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  backend:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+      network: host
+      args:
+        # HTTP forwarder (gost) → host SOCKS 127.0.0.1:1081 — Prisma needs HTTP proxy
+        HTTP_PROXY: http://127.0.0.1:8118
+        HTTPS_PROXY: http://127.0.0.1:8118
+        ALL_PROXY: http://127.0.0.1:8118
+    image: badi-pwa-backend:latest
+    container_name: badi-pwa-backend
+    ports:
+      - "3001:3001"
+    restart: unless-stopped
+    env_file:
+      - ./backend/.env
+    environment:
+      - NODE_ENV=production
+      - PORT=3001
+      - HOST=0.0.0.0
+      # DATABASE_URL comes from backend/.env (do not hardcode credentials here)
+      - CORS_ORIGIN=https://pwa.feep.ir,https://novya.ir
+      - TRUST_PROXY=true
+    depends_on:
+      mysql:
+        condition: service_healthy
+
   app:
     build:
       context: .
       dockerfile: Dockerfile
-    container_name: pwa-react-app
+      network: host
+      args:
+        HTTP_PROXY: http://127.0.0.1:8118
+        HTTPS_PROXY: http://127.0.0.1:8118
+        ALL_PROXY: http://127.0.0.1:8118
+    image: badi-pwa-app:latest
+    container_name: badi-pwa-app
     ports:
-      - "3000:80"
+      - "3020:80"
     restart: unless-stopped
     environment:
       - NODE_ENV=production
-    healthcheck:
-      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost/health", "||", "exit", "1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 40s
+    depends_on:
+      - backend
 
+volumes:
+  badi_pwa_mysql_data: