chore: pin compose project and pass server token from .env

.gitignore

@@ -11,3 +11,4 @@ dist/
 .agents/ignore/
 test-results/
 mise.local.toml
+.env

README.md

@@ -174,8 +174,13 @@ mise run docker:down
 
 Compose publishes HTTP on `127.0.0.1:7980`, outside the local 7981–7990 range,
 and preserves the named SQLite volume when stopped or recreated. Set
-`DIFFX_SERVER_PORT=7979` to publish another host port. Retrieve
+`DIFFX_SERVER_PORT=7979` to publish another host port. The project is named
+`diffx`, so its volume is shared by every checkout. Retrieve
 the initial credential with `docker compose cp server:/data/state.db.admin-token ./admin-token`.
+To choose the credential instead, put `DIFFX_SERVER_TOKEN=…` (at least 32
+characters) in a git-ignored `.env` beside `compose.yaml` before the first start.
+It only applies to a new database; a different token for an existing account
+fails startup.
 See [server development](docs/development.md#server-development) for configuration
 and persistence details. Deploy behind HTTPS when exposing the server remotely.
 

compose.yaml

@@ -1,3 +1,6 @@
+# A fixed project name keeps the data volume independent of the checkout directory.
+name: diffx
+
 services:
   server:
     build: .
@@ -8,6 +11,8 @@ services:
       DIFFX_SERVER_STATE: /data/state.db
       DIFFX_SERVER_ACCOUNT: "${DIFFX_SERVER_ACCOUNT:-admin}"
       DIFFX_SERVER_RETENTION_DAYS: "${DIFFX_SERVER_RETENTION_DAYS:-7}"
+      # Bootstrap credential for a new database; empty generates one.
+      DIFFX_SERVER_TOKEN: "${DIFFX_SERVER_TOKEN:-}"
     ports:
       # Only the published host port varies; local `diffx [PATH]` uses 7981-7990.
       - "127.0.0.1:${DIFFX_SERVER_PORT:-7980}:7980"

docs/development.md

@@ -186,7 +186,10 @@ starting with a fresh database; a volume is not a backup.
 
 Set `DIFFX_SERVER_PORT=7979 mise run docker:up` for a different published host
 port; the container always listens on 7980. Compose also accepts
-`DIFFX_SERVER_ACCOUNT` and `DIFFX_SERVER_RETENTION_DAYS` overrides.
+`DIFFX_SERVER_ACCOUNT`, `DIFFX_SERVER_RETENTION_DAYS` and `DIFFX_SERVER_TOKEN`
+overrides, from the shell or a git-ignored `.env` beside `compose.yaml`. An empty
+token keeps the generated credential. The fixed `diffx` project name keeps one
+volume regardless of the checkout directory.
 For other settings, use image env overrides or a Compose override file.
 Only one server may own a SQLite database; competing starts fail rather than
 share ownership. SIGTERM stops HTTP and workers before releasing storage;