Create monorepo from known-good production state

docker-compose.yml

@@ -0,0 +1,78 @@
+services:
+  makearmy-app:
+    build:
+      context: ./app
+      dockerfile: Dockerfile
+    container_name: makearmy-app
+    restart: unless-stopped
+
+    # Load secrets/config without baking into image
+    env_file:
+      - /var/www/lasereverything.net.db/app/.env.local
+
+    # Run as non-root
+    user: "1000:1000"
+
+    environment:
+      - NODE_ENV=production
+      - NEXT_PUBLIC_API_BASE_URL=https://forms.lasereverything.net
+      - NEXT_PUBLIC_FILE_API_BASE_URL=https://db.lasereverything.net
+      - NEXT_PUBLIC_MAIN_MENU_URL=https://db.lasereverything.net
+      - BGREMOVER_BASE_URL=http://bgbye:7001
+      - BG_BYE_UPSTREAM=http://bgbye:7001/remove_background/
+      - FILES_ROOT=/app/files
+      - HOME=/tmp
+      - NEXT_TELEMETRY_DISABLED=1
+
+    # Harden
+    read_only: true
+    tmpfs:
+      - /tmp:noexec,nosuid,nodev,size=256m,mode=1777
+      - /run:noexec,nosuid,nodev,size=64m,mode=755
+      - /app/.next/cache:noexec,nosuid,nodev,size=512m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+    # Only mount what must be writable
+    volumes:
+      - /var/www/lasereverything.net.db/app/files:/app/files:rw
+
+    ports:
+      - "127.0.0.1:3005:3000"
+
+    networks:
+      - makearmy_net
+
+  bgbye:
+    build:
+      context: ./bgbye
+      dockerfile: Dockerfile.gpu
+    container_name: bgbye
+    restart: unless-stopped
+    runtime: nvidia
+
+    environment:
+      - NVIDIA_VISIBLE_DEVICES=all
+      - NVIDIA_DRIVER_CAPABILITIES=compute,utility
+      - OMP_NUM_THREADS=1
+      - PYTHONWARNINGS=ignore
+
+    ports:
+      - "127.0.0.1:7001:7001"
+
+    volumes:
+      # cache directory
+      - ./bgbye/.cache:/root/.cache
+
+      # model caches (prevents re-downloading)
+      - ./bgbye/.u2net:/root/.u2net
+      - ./bgbye/.ormbg:/root/.ormbg
+
+    networks:
+      - makearmy_net
+
+networks:
+  makearmy_net:
+    external: true