# Deploying on Coolify

The repo ships a multi-stage `Dockerfile`. On every container start,
`docker-entrypoint.sh` applies pending Prisma migrations, runs the idempotent
seed (default categories + admin bootstrap), then starts the standalone
Next.js server on port 3000.

## One-time setup

1. **Database** — in Coolify, create a **PostgreSQL** resource. Copy its
   *internal* connection URL (the app and DB talk over Coolify's internal
   network).
2. **Application** — create an application from this git repository.
   - Build pack: **Dockerfile**
   - Port: **3000**
3. **Environment variables** (set in Coolify, mark secrets as such):

   | Variable | Value |
   | --- | --- |
   | `DATABASE_URL` | internal Postgres URL from step 1 |
   | `AUTH_SECRET` | generate with `openssl rand -base64 32` |
   | `AUTH_TRUST_HOST` | `true` (required behind Coolify's reverse proxy) |
   | `ADMIN_EMAIL` | login email for the first admin user |
   | `ADMIN_PASSWORD` | initial admin password (change after first login) |

   Optional: the `S3_*` variables enable cover-image uploads (any
   S3-compatible store, e.g. Cloudflare R2 or a Coolify-hosted MinIO);
   `TMDB_API_KEY`, `GOOGLE_BOOKS_API_KEY`, `SPOTIFY_CLIENT_ID/SECRET`,
   `GOOGLE_PLACES_API_KEY`, `YELP_API_KEY` enable metadata lookups.
   `NEXTAUTH_URL` is not needed — `AUTH_TRUST_HOST=true` derives the URL
   from the request.

4. **Domain** — assign your domain/HTTPS in Coolify and deploy.

The admin user is only created if no admin exists yet, and the seed never
overwrites categories you've edited, so redeploys are safe.

## Health check (optional)

Unauthenticated requests to `/` redirect to `/login`, so point Coolify's
health check at `/login` (expects HTTP 200).

## Local production image test

```bash
docker build -t mystuff2 .
docker run --rm -p 3000:3000 \
  -e DATABASE_URL=... -e AUTH_SECRET=... -e AUTH_TRUST_HOST=true \
  -e ADMIN_EMAIL=... -e ADMIN_PASSWORD=... mystuff2
```