fix docker auth

docker-compose.yml

@@ -6,13 +6,18 @@ services:
     environment:
       PORT: 3000
       NODE_ENV: production
+      # CONFIG_PATH points db.ts and secret.ts at the config volume so medialore.db
+      # and .session_secret are created as files inside an existing directory mount.
+      # Without this Docker will create ./medialore.db on the host as an empty directory,
+      # which causes better-sqlite3 to fail with SQLITE_CANTOPEN.
+      CONFIG_PATH: /config
+      # Set to "true" only when serving over HTTPS (e.g. behind a TLS reverse proxy).
+      # Keeping this "false" allows the session cookie to be sent over plain HTTP.
+      COOKIE_SECURE: "false"
     volumes:
-      # Runtime data — must map to /app/ since process.cwd() = /app in the container
-      - ./medialore.db:/app/medialore.db
       - ./.thumbnails:/app/.thumbnails
-      # Library config — mounted as a directory so the atomic rename in the API works.
-      # A single-file bind-mount causes EBUSY on rename() because .tmp and the target
-      # end up on different devices. Initialize before first run:
+      # Library config, database, and session secret — all in one directory volume.
+      # Initialize before first run:
       #   mkdir -p config && echo '[]' > config/libraries.json
       - ./config:/config