Docker: PocketBase with media in S3, SeaweedFS or split SeaweedFS

Six compose files for the separate-container setup, a build and a prod
file for each, modelled on DriverVault's Docker folder:

- pocketbase.s3: media in an existing bucket elsewhere; the endpoint
  and key pair are required, host.docker.internal is mapped, and the
  homeserver waits up to 30 seconds for the endpoint before starting.
- pocketbase.seaweedfs: SeaweedFS as one `weed server -s3` container
  whose only identity is the homeserver's key pair, plus a one-shot
  init that creates the bucket.
- pocketbase.seaweedfs.split: master, volume, filer, S3 gateway and
  admin UI as separate containers; the init seeds the bucket and the
  homeserver's identity into the filer's IAM store, and the gateway
  waits for it.

Only the S3 gateway and admin UI are published, on loopback. Both
SeaweedFS files share one project and data layout, so switching needs
no migration. .env.example gains the SEAWEED_* settings and leaves
WARP_PB_S3_FORCE_PATH_STYLE empty so the S3 file's default applies.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker/.env.example

@@ -31,6 +31,31 @@ WARP_VERSION=latest
 # refuses to start without it.
 WARP_POSTGRES_PASSWORD=change-me
 
+# ------------------------------------------------------------- seaweedfs
+
+# docker-compose.pocketbase.seaweedfs*.yml only; set WARP_PB_S3_ACCESS_KEY
+# and WARP_PB_S3_SECRET below as well.
+#
+# The SeaweedFS image every SeaweedFS container runs. Pin it: the data
+# volume outlives the image.
+SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
+
+# The S3 gateway's host port, on loopback unless the bind address says
+# otherwise. The homeserver reaches it over the compose network; this is
+# for aws-cli and the like.
+SEAWEED_S3_BIND=127.0.0.1
+SEAWEED_S3_PORT=8333
+
+# The split file only: SeaweedFS's admin UI. It can mint credentials for
+# the bucket, so the password is required. Put it behind a reverse proxy
+# before binding it to 0.0.0.0. The read-only login is optional.
+SEAWEED_ADMIN_BIND=127.0.0.1
+SEAWEED_ADMIN_PORT=23646
+SEAWEED_ADMIN_USER=admin
+SEAWEED_ADMIN_PASSWORD=
+SEAWEED_ADMIN_READONLY_USER=
+SEAWEED_ADMIN_READONLY_PASSWORD=
+
 # ------------------------------------------------------------ homeserver
 
 # Part of every user and room ID: it cannot be changed later.
@@ -87,13 +112,23 @@ WARP_DB_AUTO_MIGRATE=
 # docker-compose.pocketbase*.yml only: keep media in an S3 bucket instead
 # of pb_data/storage. Bucket, region, endpoint and keys are all required
 # when it is on.
+#
+# The pocketbase.seaweedfs files turn it on themselves, against their own
+# SeaweedFS; there only the access key and secret are needed (required:
+# they are the gateway's credentials too), and the bucket defaults to warp.
+#
+# The pocketbase.s3 files turn it on against a bucket elsewhere: the
+# endpoint, access key and secret are required, the bucket (default warp)
+# must exist, the region defaults to us-east-1 and path style to true
+# (SeaweedFS, MinIO; set false for AWS S3). For a gateway on the Docker
+# host, use http://host.docker.internal:8333.
 WARP_PB_S3_ENABLED=false
 WARP_PB_S3_BUCKET=
 WARP_PB_S3_REGION=
 WARP_PB_S3_ENDPOINT=
 WARP_PB_S3_ACCESS_KEY=
 WARP_PB_S3_SECRET=
-WARP_PB_S3_FORCE_PATH_STYLE=false
+WARP_PB_S3_FORCE_PATH_STYLE=
 
 # Client API. Defaults *, false, 0s (never expire), 0s, true.
 WARP_CORS_ALLOWED_ORIGINS=