Initial setup: OpenResto deployment for Lunkaberg breakfast booking

Adapts upstream's release docker-compose.yml to run behind this server's
Nginx Proxy Manager on the shared my-main-net network instead of publishing
host ports. Includes docs/ for session continuity.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014vNjtg18oTQcv8dtjwnT69

docker-compose.yml

@@ -0,0 +1,100 @@
+# OpenResto — self-hosted breakfast booking (Lunkaberg)
+#
+# Adapted from the official release compose (v2.2.0) to run behind the
+# existing Nginx Proxy Manager setup on this server: no host ports are
+# published, all services join the shared `my-main-net` network, and NPM
+# proxies straight to the `lunkaberg-reverse-proxy` container on port 80.
+#
+# Backup: see https://github.com/karanshukla/openresto/blob/main/docs/backup-restore.md
+
+volumes:
+  db_data:
+  media_data:
+
+networks:
+  main:
+    external: true
+    name: my-main-net
+
+services:
+  backend:
+    image: ghcr.io/karanshukla/openresto-backend:2.2.0
+    container_name: lunkaberg-backend
+    restart: unless-stopped
+    networks:
+      - main
+    environment:
+      - ASPNETCORE_ENVIRONMENT=Production
+      - PORT=8080
+      - CORS_ORIGINS=${CORS_ORIGINS}
+      - JWT_KEY=${JWT_KEY}
+      - ADMIN_EMAIL=${ADMIN_EMAIL}
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
+      - CONNECTION_STRING=Data Source=/data/openresto.db
+      - DATA_PROTECTION_KEYS_PATH=/data/dp-keys
+      - Vapid__PublicKey=${VAPID_PUBLIC_KEY:-}
+      - Vapid__PrivateKey=${VAPID_PRIVATE_KEY:-}
+      - Vapid__Subject=${VAPID_SUBJECT:-}
+      - GuestPush__ReminderLeadHours=${GUEST_PUSH_REMINDER_LEAD_HOURS:-24,2}
+      - GuestPush__ExpoAccessToken=${EXPO_ACCESS_TOKEN:-}
+      - Wallet__Apple__PassTypeIdentifier=${APPLE_PASS_TYPE_ID:-}
+      - Wallet__Apple__TeamIdentifier=${APPLE_TEAM_ID:-}
+      - Wallet__Apple__CertificatePath=${APPLE_PASS_CERTIFICATE_PATH:-}
+      - Wallet__Apple__CertificatePassword=${APPLE_PASS_CERTIFICATE_PASSWORD:-}
+      - Wallet__Apple__WwdrCertificatePath=${APPLE_WWDR_CERTIFICATE_PATH:-}
+      - Wallet__Google__IssuerId=${GOOGLE_WALLET_ISSUER_ID:-}
+      - Wallet__Google__ServiceAccountKeyPath=${GOOGLE_WALLET_SERVICE_ACCOUNT_KEY_PATH:-}
+      - EmailSettings__Host=${SMTP_HOST:-}
+      - EmailSettings__Port=${SMTP_PORT:-587}
+      - EmailSettings__Username=${SMTP_USERNAME:-}
+      - EmailSettings__Password=${SMTP_PASSWORD:-}
+      - EmailSettings__FromEmail=${SMTP_FROM_EMAIL:-}
+      - EmailSettings__FromName=${SMTP_FROM_NAME:-Lunkaberg Frukost}
+      - EmailSettings__EnableSsl=${SMTP_ENABLE_SSL:-true}
+    volumes:
+      - db_data:/data
+      - media_data:/app/wwwroot/media
+      - ./wallet:/wallet:ro
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+  frontend:
+    image: ghcr.io/karanshukla/openresto-frontend:2.2.0
+    container_name: lunkaberg-frontend
+    restart: unless-stopped
+    networks:
+      - main
+    environment:
+      - EXPO_PUBLIC_API_URL=/api
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8081"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+  reverse-proxy:
+    image: ghcr.io/karanshukla/openresto-nginx:2.2.0
+    container_name: lunkaberg-reverse-proxy
+    restart: unless-stopped
+    networks:
+      - main
+    # No host port published — Nginx Proxy Manager reaches this container
+    # directly on my-main-net at lunkaberg-reverse-proxy:80.
+    environment:
+      - PORT=80
+      - BACKEND_HOST=backend
+      - BACKEND_PORT=8080
+      - FRONTEND_HOST=frontend
+      - FRONTEND_PORT=8081
+    volumes:
+      - media_data:/usr/share/nginx/html/media:ro
+      - ./well-known:/usr/share/nginx/html/.well-known:ro
+    depends_on:
+      backend:
+        condition: service_healthy
+      frontend:
+        condition: service_healthy