Restore source files from Google Drive backup

docker-compose.yml

@@ -117,3 +117,61 @@ services:
     mem_limit: 512m
     depends_on:
       - mc
+
+  # ── Public READ-ONLY mirror (portfolio deployment) ───────────────────────
+  # Opt-in via the "public" profile: `docker compose --profile public up -d`.
+  # This service is safe to expose to the internet. It serves ONLY the
+  # exported feed and CANNOT touch the server: no Docker socket, no project
+  # dir, no RCON password, no .env secrets. See docs/public-mode.md.
+  dashboard-public:
+    build: ./dashboard
+    image: minecraft-dashboard:local
+    container_name: mc-dashboard-public
+    restart: unless-stopped
+    profiles: ["public"]
+    environment:
+      PUBLIC_READONLY: "1"
+      FEED_PATH: /feed/feed.db
+      TZ: ${TZ:-UTC}
+    ports:
+      - "${DASHBOARD_PUBLIC_PORT:-8090}:8080"
+    volumes:
+      # Feed only, read-only. Deliberately NO docker.sock / project / secrets.
+      - ./data/feed:/feed:ro
+    mem_limit: 256m
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/api/health"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+    depends_on:
+      - feed-export
+
+  # ── Feed exporter sidecar ────────────────────────────────────────────────
+  # Snapshots the LAN panel DB (read-only) into the public feed on an interval.
+  # Reads only the panel DB; writes only the feed volume. No server access.
+  feed-export:
+    build: ./dashboard
+    image: minecraft-dashboard:local
+    container_name: mc-feed-export
+    restart: unless-stopped
+    profiles: ["public"]
+    working_dir: /app
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - 'while true; do node scripts/export-feed.mjs || echo "export failed"; sleep ${FEED_INTERVAL_SECONDS:-30}; done'
+    environment:
+      SOURCE_DB: /app-data/craftdeck.db
+      FEED_PATH: /feed/feed.db
+      MC_VERSION: ${MC_VERSION:-}
+      SERVER_TYPE: ${SERVER_TYPE:-}
+      TZ: ${TZ:-UTC}
+    volumes:
+      - ./data/dashboard:/app-data:ro
+      - ./data/feed:/feed
+    mem_limit: 128m
+    healthcheck:
+      test: ["CMD", "test", "-f", "/feed/feed.db"]
+      interval: 30s
+      timeout: 5s
+      start_period: 40s