Docker: a build context that isn't 3.6GB, and health you can see

The all-in-one image builds from the project root, and Docker only reads
.dockerignore from the context root — so the ones under "API Server" and
"Web App" never applied to it and every AIO build shipped the whole tree,
"Phone App/build" included. A root .dockerignore allow-lists the paths that
build actually copies.

The dev split stack passed neither PB_BOOTSTRAP nor the SUPERADMIN vars, so
it created the schema and then no user to log in with. It passes them now,
and .env.example says so.

WEBAPP_URL was never set anywhere, leaving the panel status page probing
localhost:8090 — itself — and always reporting the Web App as down. Each
compose file now points it at wherever the Web App really is, and the BFF
grew a real /healthz instead of letting the SPA fallback answer probes with
index.html and look healthy no matter what.

In the AIO, PocketBase and the API Server drop to an unprivileged user;
only nginx stays root to bind :80. The entrypoint takes ownership of the
two volumes first, so data written by the old root-only image stays
writable. All three images carry a HEALTHCHECK, every compose file declares
one too (so depends_on still gates against an older pulled image), and
web-app waits for the API Server to be serving rather than merely started.

Also: pinned alpine/golang/node and PocketBase 0.39.11, so a rebuild months
from now produces the same image; nginx forwards WebSocket upgrades instead
of stripping them, with the map in http.d where Alpine actually reads it;
and a .gitattributes keeps entrypoint.sh on LF, because a CRLF shebang from
a Windows clone fails at container start with "no such file or directory".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Docker/docker-compose.yml

@@ -42,10 +42,21 @@ services:
       POCKETBASE_URL: "http://pocketbase:8070"
       POCKETBASE_ADMIN_EMAIL: "${PB_ADMIN_EMAIL}"
       POCKETBASE_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD}"
+      # Probed by the panel status page. This is a server-to-server call inside
+      # the compose network, so it must be the service name — the default
+      # (localhost:8090) would resolve to this container itself.
+      WEBAPP_URL: "http://web-app:8090"
       # Same-origin requests go through the Web App BFF, so CORS is only needed
       # if the browser ever calls the API Server directly. Default to the web origin.
       CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
       AUTH_USERS_COLLECTION: "${AUTH_USERS_COLLECTION:-users}"
+      # Schema + super-admin bootstrap (idempotent). Without the SUPERADMIN vars
+      # the collections are still created but no app user is, leaving a stack
+      # you cannot log into. Set PB_BOOTSTRAP=false to skip once established.
+      PB_BOOTSTRAP: "${PB_BOOTSTRAP:-true}"
+      DRIVERVAULT_SUPERADMIN_EMAIL: "${DRIVERVAULT_SUPERADMIN_EMAIL:-}"
+      DRIVERVAULT_SUPERADMIN_PASSWORD: "${DRIVERVAULT_SUPERADMIN_PASSWORD:-}"
+      DRIVERVAULT_SUPERADMIN_NAME: "${DRIVERVAULT_SUPERADMIN_NAME:-Administrator}"
       # OCPP charger control (Anker Solix). Chargers are rejected unless they
       # connect over TLS; set OCPP_REQUIRE_TLS=false in .env only when TLS is
       # terminated in front of this stack or for local dev on a trusted network.
@@ -61,6 +72,14 @@ services:
       # Dockerfile. Without this, plugin state is lost when the container is
       # recreated.
       - api_data:/data
+    healthcheck:
+      # Declared here rather than relying only on the image's HEALTHCHECK, so the
+      # depends_on gate below still works against an older pulled image.
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8080/healthz || exit 1"]
+      interval: 10s
+      timeout: 3s
+      retries: 12
+      start_period: 20s
 
   web-app:
     build:
@@ -72,12 +91,21 @@ services:
     container_name: drivervault-web
     restart: unless-stopped
     depends_on:
-      - api-server
+      # The image now ships a HEALTHCHECK, so wait for the API Server to be
+      # serving rather than merely started.
+      api-server:
+        condition: service_healthy
     environment:
       # The BFF reverse-proxies /api/* to the API Server over the internal network.
       API_BASE: "http://api-server:8080"
     ports:
       - "${WEB_PORT:-8090}:8090"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8090/healthz || exit 1"]
+      interval: 10s
+      timeout: 3s
+      retries: 12
+      start_period: 10s
 
 volumes:
   pb_data: