The split object store moves into the image it was kept out of

Dockerfile.seaweedfs.split bakes SeaweedFS master, volume, filer, S3
gateway and admin UI into the all-in-one as five more supervisord
programs, with the weed binary copied from the official image and pinned
by SEAWEED_VERSION. The readiness chain the compose split expressed with
depends_on and healthchecks becomes until-wget loops: master, volume,
filer, then the gateway, which seeds the bucket and PocketBase's identity
and refuses to serve if the grep gate fails. The volume server sits on
8081 because 8080 is the API Server; every role except the gateway and
the admin UI binds loopback.

docker-compose.prod.seaweedfs.split.yml goes from six services to one,
with build: and image: both set so the same file builds, pushes and
pulls, under a registry name of its own since this image expects three
volumes. The env example and README follow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Docker-AIO/.env.prod.seaweedfs.split.example

@@ -1,10 +1,18 @@
-# DriverVault all-in-one — production config, SeaweedFS split into its four roles.
-# Copy to .env and fill in, then:
-#   docker compose -f docker-compose.prod.seaweedfs.split.yml pull
+# DriverVault all-in-one — production config, SeaweedFS split into its roles and
+# built into the same image (Dockerfile.seaweedfs.split). Copy to .env and fill
+# in, then:
+#   docker compose -f docker-compose.prod.seaweedfs.split.yml build
 #   docker compose -f docker-compose.prod.seaweedfs.split.yml up -d
+# The build needs the repo checkout; to deploy elsewhere, `push` after building
+# and `pull` on the deploy host.
 
-# --- Registry image ----------------------------------------------------------
-AIO_IMAGE=10.2.1.10:5500/admin/drivervault-aio:latest
+# --- Image -------------------------------------------------------------------
+# The tag the build produces and `push`/`pull` use. Its own name, not
+# drivervault-aio: this image carries SeaweedFS and expects three volumes.
+AIO_IMAGE=10.2.1.10:5500/admin/drivervault-aio-seaweedfs-split:latest
+# Build args, both pinned in the Dockerfile. Set to override at build time.
+# PB_VERSION=0.39.11
+# SEAWEED_VERSION=4.45
 
 # --- PocketBase superuser (required) -----------------------------------------
 # Created/updated on first boot. The API Server uses these to manage the database.
@@ -67,41 +75,39 @@ PB_DATA=pb_data
 # receipts, workshop invoices, part photos — in the bucket below instead of on
 # PB_DATA. The database and PocketBase's own backups stay where they are.
 #
-# The credentials do double duty: seaweedfs-init writes them into the filer's
-# IAM store as the identity named "drivervault" *and* they are what PocketBase
-# authenticates with. There are no safe defaults, and the stack refuses to start
-# without them. Change them here and restart to rotate: the seed updates the
-# identity in place rather than adding a second one.
+# The credentials do double duty: the S3 gateway's program writes them into the
+# filer's IAM store as the identity named "drivervault" *and* they are what
+# PocketBase authenticates with. There are no safe defaults, and the container
+# refuses to start without them. Change them here and restart to rotate: the
+# seed updates the identity in place rather than adding a second one.
 PB_S3_ACCESS_KEY=
 PB_S3_SECRET=
-# The bucket. Created on first boot by the seaweedfs-init container.
+# The bucket. Created on first boot by the S3 gateway's program.
 PB_S3_BUCKET=drivervault
-# SeaweedFS ignores the region; PocketBase insists on having one.
-PB_S3_REGION=us-east-1
+# The endpoint, region and path style are fixed by the image — the gateway is
+# inside the container at a loopback address that cannot change.
 
 # SEAWEED_DATA — where SeaweedFS keeps the files. A Docker-managed named volume
 # by default; set an absolute host path for a bind mount, the same way PB_DATA
 # works above. Back it up alongside PB_DATA: from here on the attachments live
 # here, not in the database volume.
 #
-# The master, volume and filer containers all mount it at /data, which is the
-# layout `weed server -dir=/data` writes — so this file and
+# Master, volume and filer share it (mounted at /seaweed/data), which is the
+# layout `weed server -dir` writes — so this file and
 # docker-compose.prod.seaweedfs.yml are interchangeable on the same volume, with
 # nothing to migrate either way.
 SEAWEED_DATA=seaweed_data
-# The SeaweedFS image, pinned so a redeploy months from now brings up the same
-# one. All five SeaweedFS containers run it.
-# SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# The S3 port is published on loopback only — the stack reaches the gateway over
-# the compose network, and this is for tools like aws-cli. Set
+# The S3 port is published on loopback only — PocketBase reaches the gateway
+# inside the container, and this is for tools like aws-cli. Set
 # SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
 # SEAWEED_S3_BIND=127.0.0.1
 # SEAWEED_S3_PORT=8333
 #
-# The master, volume and filer publish no host port at all. The admin UI below
-# shows what they would: the volume server in particular serves file content by
-# id with no authentication, so it stays on the compose network. Reach the
-# others with `docker compose exec`.
+# The master, volume and filer listen on the container's loopback and publish
+# no host port at all. The admin UI below shows what they would: the volume
+# server in particular serves file content by id with no authentication. Reach
+# them with `docker compose exec drivervault wget -qO- http://127.0.0.1:9333/...`
+# (volume 8081, filer 8888).
 
 # --- SeaweedFS admin UI ------------------------------------------------------
 # Cluster topology, volumes, buckets, maintenance tasks, and Object Store →
@@ -110,7 +116,8 @@ SEAWEED_DATA=seaweed_data
 # without a restart.
 #
 # REQUIRED: weed disables authentication entirely when the password is empty,
-# and this panel can mint credentials for the bucket.
+# and this panel can mint credentials for the bucket — so the image refuses to
+# start the panel at all without one, and the container stays unhealthy.
 SEAWEED_ADMIN_USER=admin
 SEAWEED_ADMIN_PASSWORD=
 # Optional view-only login.