Make Coolify service ports configurable

apps/web/.env.example

@@ -68,6 +68,20 @@ DB_DISABLE_SSL=true
 POSTGRES_PORT=5432
 GARAGE_API_PORT=3900
 
+# Coolify Compose container listener ports. APP_PORT is Coolify-only;
+# POSTGRES_PORT and GARAGE_API_PORT are reused from above. The regular/dev
+# compose files keep the database and Garage container ports at 5432/3900 and
+# use those variables only for host-side mappings.
+APP_PORT=3000
+GARAGE_RPC_PORT=3901
+GARAGE_WEB_PORT=3902
+GARAGE_ADMIN_PORT=3903
+# Garage requires a 64-character hexadecimal RPC secret. Generate with:
+# openssl rand -hex 32
+# GARAGE_RPC_SECRET=
+# GARAGE_ADMIN_TOKEN=
+# GARAGE_METRICS_TOKEN=
+
 # Optional: if Next dev picks another port, you do not need to change URLs for
 # sign-in — the auth client uses window.location.origin in the browser.
 
@@ -138,7 +152,8 @@ NEXT_PUBLIC_UMAMI_SCRIPT_URL=https://analytics.umami.is/script.js
 #   • Coolify — see docs/COOLIFY.md. Summary:
 #     - Best: one Compose resource with docker-compose.coolify.yml (app+db+garage).
 #     - Application + separate Garage: ENOTFOUND garage → set S3_ENDPOINT to
-#       SERVICE_URL_GARAGE_3900 (public domain) OR http://garage-<resource-uuid>:3900
+#       SERVICE_URL_GARAGE (public domain) OR
+#       http://garage-<resource-uuid>:<GARAGE_API_PORT>
 #       with Connect to Predefined Network on both resources. Never bare "garage".
 #     - NEVER use localhost in production — inside the app container that is the app, not Garage.
 #
@@ -150,8 +165,8 @@ S3_SECRET_KEY=7d37d093435a41f2aab8f13c19ba067d9776c90215f56614adad6ece597dbb34
 S3_REGION=garage
 # S3_FORCE_PATH_STYLE=true   # default on when S3_ENDPOINT is set; required for Garage/HTTPS proxy
 #
-# docker-compose.yml sets S3_ENDPOINT=http://garage:3900 inside the app container
-# automatically. S3_ACCESS_KEY / S3_SECRET_KEY must match the garage service env.
+# docker-compose.yml uses http://garage:3900 internally. The Coolify compose
+# derives the internal URL from GARAGE_API_PORT. Credentials must match Garage.
 
 # =============================================================================
 # SSO — Authentik OIDC (optional)