DONE: use ip for frontend but point to domain for api

be/.env.example

@@ -1,6 +1,7 @@
 # Host ports (change these if they collide on your single server)
 BACKEND_HOST_PORT=8080
-# MySQL is internal-only (not published to the host)
+# Published for DBeaver/tools (container still uses 3306 internally)
+MYSQL_HOST_PORT=3307
 
 # MySQL
 # Quote if the password contains special chars like ; # $

be/.env.production

@@ -1,6 +1,7 @@
 # Host ports (change these if they collide on your single server)
 BACKEND_HOST_PORT=8080
-# MySQL is internal-only (not published to the host)
+# Published for DBeaver/tools (container still uses 3306 internally)
+MYSQL_HOST_PORT=3307
 
 # MySQL
 MYSQL_ROOT_PASSWORD="R8qjjBJDg9NtL2IwcnoFMkn8pktwAZ;wsl"

be/docker-compose.yml

@@ -3,15 +3,23 @@ services:
     image: mysql:8
     container_name: qms-mysql
     restart: unless-stopped
-    # Do not publish 3306 to the host — avoids clashes with host MySQL.
-    # Backend reaches it as hostname "mysql" on the internal Docker network.
+    ports:
+      - "${MYSQL_HOST_PORT:-3307}:3306"
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-password}
       MYSQL_DATABASE: ${MYSQL_DATABASE:-qms}
     volumes:
       - qms-mysql-data:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-p${MYSQL_ROOT_PASSWORD:-password}"]
+      test:
+        [
+          "CMD",
+          "mysqladmin",
+          "ping",
+          "-h",
+          "localhost",
+          "-p${MYSQL_ROOT_PASSWORD:-password}",
+        ]
       interval: 5s
       timeout: 5s
       retries: 20