Fix Docker stack bootstrap

.env.example

@@ -17,7 +17,7 @@ POSTGRES_PASSWORD=changeme_super
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=changeme_minio_root
 MINIO_ENDPOINT=minio:9000
-# App-level access key — minimal permissions on docuvault bucket only
+# App-level access key. docker-compose.yml provisions this user and a bucket-scoped policy.
 MINIO_ACCESS_KEY=docuvault_app
 MINIO_SECRET_KEY=changeme_minio_app
 MINIO_BUCKET=docuvault
@@ -51,9 +51,9 @@ SMTP_PASSWORD=
 SMTP_FROM=noreply@docuvault.local
 
 # ── CORS (Phase 2 — D-09) ────────────────────────────────────────────────────
-# Comma-separated list of allowed origins. Default: http://localhost:5173
-# Example for production: https://app.docuvault.example.com
-CORS_ORIGINS=http://localhost:5173
+# JSON list of allowed origins. Default: ["http://localhost:5173"]
+# Example for production: ["https://app.docuvault.example.com"]
+CORS_ORIGINS=["http://localhost:5173"]
 
 # ── Cloud Storage Backends (Phase 5) ─────────────────────────────────────────
 # Master key for HKDF per-user cloud credential encryption.

README.md

@@ -158,13 +158,14 @@ Copy `.env.example` to `.env`. Only the fields marked **Required** must be set b
 | `ADMIN_PASSWORD` | Bootstrap admin password (must pass strength check) |
 | `POSTGRES_PASSWORD` | PostgreSQL superuser password |
 | `MINIO_ROOT_PASSWORD` | MinIO root password |
+| `MINIO_ACCESS_KEY` / `MINIO_SECRET_KEY` | App-level MinIO credentials; Docker Compose provisions this user and bucket policy |
 | `REDIS_PASSWORD` | Redis `requirepass` password |
 
 ### Optional (sensible defaults for local dev)
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `CORS_ORIGINS` | `http://localhost:5173` | Comma-separated allowed origins |
+| `CORS_ORIGINS` | `["http://localhost:5173"]` | JSON list of allowed origins |
 | `SMTP_HOST` | *(unset)* | Leave empty to log password-reset links to stdout |
 | `LOG_JSON` | `false` | Set `true` in production for structured JSON logs |
 | `DEFAULT_AI_PROVIDER` | `ollama` | Used on first boot seed; overridable per-user in admin panel |

docker-compose.yml

@@ -37,6 +37,55 @@ services:
       retries: 5
       start_period: 15s
 
+  minio-init:
+    image: minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_healthy
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
+      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
+      MINIO_BUCKET: ${MINIO_BUCKET}
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        set -eu
+        mc alias set local http://minio:9000 "$$MINIO_ROOT_USER" "$$MINIO_ROOT_PASSWORD"
+        mc mb --ignore-existing "local/$$MINIO_BUCKET"
+        mc admin user add local "$$MINIO_ACCESS_KEY" "$$MINIO_SECRET_KEY" || true
+        cat > /tmp/docuvault-policy.json <<EOF
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": [
+                "s3:ListBucket",
+                "s3:GetBucketLocation"
+              ],
+              "Resource": [
+                "arn:aws:s3:::$$MINIO_BUCKET"
+              ]
+            },
+            {
+              "Effect": "Allow",
+              "Action": [
+                "s3:GetObject",
+                "s3:PutObject",
+                "s3:DeleteObject"
+              ],
+              "Resource": [
+                "arn:aws:s3:::$$MINIO_BUCKET/*"
+              ]
+            }
+          ]
+        }
+        EOF
+        mc admin policy create local docuvault-app /tmp/docuvault-policy.json || true
+        mc admin policy attach local docuvault-app --user "$$MINIO_ACCESS_KEY"
+
   redis:
     image: redis:7-alpine
     command: redis-server --requirepass ${REDIS_PASSWORD}
@@ -66,7 +115,7 @@ services:
       - JWT_PUBLIC_KEY=${JWT_PUBLIC_KEY}
       - ADMIN_EMAIL=${ADMIN_EMAIL}
       - ADMIN_PASSWORD=${ADMIN_PASSWORD}
-      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
+      - CORS_ORIGINS=${CORS_ORIGINS:-["http://localhost:5173"]}
       - FRONTEND_URL=${FRONTEND_URL:-http://localhost:5173}
       - PYTHONDONTWRITEBYTECODE=1
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
@@ -82,6 +131,8 @@ services:
         condition: service_healthy
       minio:
         condition: service_healthy
+      minio-init:
+        condition: service_completed_successfully
       redis:
         condition: service_healthy
     read_only: true
@@ -119,6 +170,8 @@ services:
         condition: service_healthy
       minio:
         condition: service_healthy
+      minio-init:
+        condition: service_completed_successfully
       redis:
         condition: service_healthy
     read_only: true
@@ -148,6 +201,8 @@ services:
         condition: service_healthy
       minio:
         condition: service_healthy
+      minio-init:
+        condition: service_completed_successfully
       redis:
         condition: service_healthy
     read_only: true

frontend/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-alpine
+FROM node:22-alpine
 
 WORKDIR /app