FIx some for production again

docker-compose.yml

@@ -1,78 +1,102 @@
+version: '3.8'
+
 services:
   postgres:
-    image: postgres:15-alpine
+    image: docker.arvancloud.ir/postgres:15-alpine
     container_name: lucky_wheel_postgres
-    restart: unless-stopped
     environment:
-      POSTGRES_DB: lucky_wheel
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgrespassword
+      POSTGRES_USER: ${POSTGRES_USER:-postgres}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgrespassword}
+      POSTGRES_DB: ${POSTGRES_DB:-lucky_wheel}
     ports:
-      - "5432:5432"
+      - "${EXTERNAL_DB_PORT:-5432}:5432"
     volumes:
       - pg_data:/var/lib/postgresql/data
+    restart: unless-stopped
     healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -U postgres -d lucky_wheel" ]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-lucky_wheel}"]
       interval: 5s
       timeout: 5s
-      retries: 5
+      retries: 12
 
   redis:
-    image: redis:7-alpine
+    image: docker.arvancloud.ir/redis:7-alpine
     container_name: lucky_wheel_redis
     restart: unless-stopped
-    ports:
-      - "6380:6379"
     volumes:
       - redis_data:/data
     healthcheck:
-      test: [ "CMD", "redis-cli", "ping" ]
+      test: ["CMD", "redis-cli", "ping"]
       interval: 5s
       timeout: 5s
       retries: 5
 
   api:
     build:
-      context: .
-      dockerfile: apps/api/Dockerfile
+      context: ./apps/api
+      dockerfile: Dockerfile
     container_name: lucky_wheel_api
-    restart: unless-stopped
-    ports:
-      - "3001:3000"
-    environment:
-      - DATABASE_URL=postgresql://postgres:postgrespassword@postgres:5432/lucky_wheel?schema=public
-      - REDIS_HOST=redis
-      - REDIS_PORT=6379
-      - NODE_ENV=production
+    # Prisma connects on module init, so a not-yet-ready DB crash-loops the API.
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_healthy
+    environment:
+      - DATABASE_URL=${DATABASE_URL:-postgresql://postgres:postgrespassword@postgres:5432/lucky_wheel?schema=public}
+      - PORT=${PORT:-3000}
+      - NODE_ENV=production
+      - REDIS_HOST=redis
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
+      - JWT_USER_SECRET=${JWT_USER_SECRET:-lucky_wheel_user_jwt_super_secret_key_2026!}
+      - JWT_USER_EXPIRES_IN=${JWT_USER_EXPIRES_IN:-7d}
+      - JWT_ADMIN_ACCESS_SECRET=${JWT_ADMIN_ACCESS_SECRET:-lucky_wheel_admin_access_jwt_super_secret_key_2026!}
+      - JWT_ADMIN_ACCESS_EXPIRES_IN=${JWT_ADMIN_ACCESS_EXPIRES_IN:-1h}
+      - JWT_ADMIN_REFRESH_SECRET=${JWT_ADMIN_REFRESH_SECRET:-lucky_wheel_admin_refresh_jwt_super_secret_key_2026!}
+      - JWT_ADMIN_REFRESH_EXPIRES_IN=${JWT_ADMIN_REFRESH_EXPIRES_IN:-7d}
+      - CORS_ADMIN_ORIGIN=${CORS_ADMIN_ORIGIN:-http://localhost:5173}
+      - CORS_CLIENT_ORIGIN=${CORS_CLIENT_ORIGIN:-http://localhost:5174}
+      - STORAGE_DRIVER=${STORAGE_DRIVER:-local}
+      - STORAGE_LOCAL_ROOT=${STORAGE_LOCAL_ROOT:-./uploads}
+      - STORAGE_PUBLIC_URL=${STORAGE_PUBLIC_URL:-}
+      - SMS_DRIVER=${SMS_DRIVER:-mock}
+      - RAYGAN_SMS_USERNAME=${RAYGAN_SMS_USERNAME:-}
+      - RAYGAN_SMS_PASSWORD=${RAYGAN_SMS_PASSWORD:-}
+      - RAYGAN_SMS_LINE_NUMBER=${RAYGAN_SMS_LINE_NUMBER:-}
+      - RAYGAN_SMS_API_BASE_URL=${RAYGAN_SMS_API_BASE_URL:-https://api.raygansms.com}
+    # No host ports — Dokploy/Traefik routes by domain to container port 3000
+    expose:
+      - "3000"
+    restart: unless-stopped
+    # The bare name "api" is ambiguous on Dokploy's shared network (other stacks
+    # register it too), which made nginx dial the wrong containers. Use a unique alias.
+    networks:
+      default:
+        aliases:
+          - luckywheel-api
 
   admin:
     build:
-      context: .
-      dockerfile: apps/admin/Dockerfile
-      args:
-        VITE_CLIENT_PUBLIC_URL: ${VITE_CLIENT_PUBLIC_URL:-}
+      context: ./apps/admin
+      dockerfile: Dockerfile
     container_name: lucky_wheel_admin
+    # No host ports — Dokploy/Traefik routes by domain to container port 80
+    expose:
+      - "80"
     restart: unless-stopped
-    ports:
-      - "5173:80"
-      - "8080:80"
     depends_on:
       - api
 
   client:
     build:
-      context: .
-      dockerfile: apps/client/Dockerfile
+      context: ./apps/client
+      dockerfile: Dockerfile
     container_name: lucky_wheel_client
+    # No host ports — Dokploy/Traefik routes by domain to container port 80
+    expose:
+      - "80"
     restart: unless-stopped
-    ports:
-      - "5174:80"
-      - "80:80"
     depends_on:
       - api