From 4003198ac0e638cb6ebd9f971d3226fdb2b63de2 Mon Sep 17 00:00:00 2001
From: Talha Ahmed <talha.ahmed@utopiabrands.com>
Date: Thu, 20 Aug 2026 19:06:19 +0500
Subject: [PATCH] Avoid host port clashes with Ahmed's app by exposing prod web
 on 81 and the local API on 8001.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 ar-aging-app/docker-compose.prod.yml | 21 +++++++++++++++++----
 ar-aging-app/docker-compose.yml      |  3 ++-
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/ar-aging-app/docker-compose.prod.yml b/ar-aging-app/docker-compose.prod.yml
index 4f56074..41119cf 100644
--- a/ar-aging-app/docker-compose.prod.yml
+++ b/ar-aging-app/docker-compose.prod.yml
@@ -1,4 +1,4 @@
-# Production stack: caddy (auto-HTTPS) -> web (nginx: SPA + /api proxy) -> backend + mysql.
+# Production stack: [your reverse proxy] -> web (nginx: SPA + /api proxy) -> backend + mysql.
 #
 #   cp .env.example .env.production   # fill the PRODUCTION section first
 #   docker compose --env-file .env.production -f docker-compose.prod.yml up -d --build
@@ -6,6 +6,15 @@
 # --env-file is REQUIRED: the ${AR_DOMAIN} / ${MYSQL_ROOT_PASSWORD} references below are
 # resolved from it (env_file: alone only feeds the containers, not this YAML).
 #
+# SHARED SERVER (default): the app's only host port is 127.0.0.1:81 (the web UI). Point
+# the server's reverse proxy for ar.utopiabrands.com at http://127.0.0.1:81 with
+#   client_max_body_size 2g; proxy_read_timeout 600s; proxy_request_buffering off;
+# All other ports (backend 8000, mysql 3306) are container-internal and can never
+# conflict with other apps on the box.
+#
+# DEDICATED SERVER: nothing else on 80/443? Start the bundled auto-HTTPS front instead:
+#   docker compose --env-file .env.production -f docker-compose.prod.yml --profile caddy up -d --build
+#
 # Sized for one 8 GB server (300-500 MB Excel parsing needs the RAM). Backend runs ONE
 # worker by design — jobs and their progress live in-process. See deploy/DEPLOY.md.
 
@@ -55,13 +64,17 @@ services:
     restart: unless-stopped
     depends_on:
       - backend
-    # Not exposed directly — caddy fronts it with TLS.
+    ports:
+      # Loopback-only: reachable by the server's own reverse proxy, never the internet.
+      # Host port 81 avoids clashing with anything else on a shared box.
+      - "127.0.0.1:81:80"
 
-  # TLS terminator: automatic Let's Encrypt certificates for AR_DOMAIN, renewed by itself.
-  # No certbot cron, no cert plumbing. Set AR_DOMAIN (and a DNS A record) and it works.
+  # OPTIONAL auto-HTTPS front for a DEDICATED server (--profile caddy). Not started by
+  # default: on a shared box another proxy usually owns 80/443 already.
   caddy:
     image: caddy:2-alpine
     restart: unless-stopped
+    profiles: ["caddy"]
     ports:
       - "80:80"
       - "443:443"
diff --git a/ar-aging-app/docker-compose.yml b/ar-aging-app/docker-compose.yml
index 189b3b8..24c7b79 100644
--- a/ar-aging-app/docker-compose.yml
+++ b/ar-aging-app/docker-compose.yml
@@ -5,7 +5,8 @@ services:
     environment:
       AR_DATA_DIR: /data
     ports:
-      - "8000:8000"
+      # Host 8001 avoids clashing with Ahmed's app on 8000.
+      - "8001:8000"
     volumes:
       - ./backend:/app
       - ar_data:/data