App	Stack	Port	Purpose
`apps/web`	React 18 + Vite + Tailwind + shadcn/ui	3000	Public website (static build served by nginx in production)
`apps/api`	Express 5 + Nodemailer	3001	Assessment intake: validates, stores in PocketBase, emails the submitter + admins
`apps/pocketbase`	PocketBase 0.40.4 (SQLite)	8090	Database, auth, admin UI

Project structure

apps/
  web/          # Frontend (src/pages, src/components, nginx.conf + Dockerfile for prod)
  api/          # Express API (src/routes, src/utils, Dockerfile)
  pocketbase/   # pb_migrations (schema, append-only), pb_hooks, Dockerfile
docker-compose.yml

Local development

npm install
cp apps/api/.env.example apps/api/.env and fill in real values.
Download the PocketBase 0.40.4 binary into apps/pocketbase/pocketbase (it is gitignored): https://github.com/pocketbase/pocketbase/releases/tag/v0.40.4
npm run dev — starts web (3000), api (3001) and pocketbase (8090) together.

Environment variables

Variable	Used by	Description
`PB_SUPERUSER_EMAIL` / `PB_SUPERUSER_PASSWORD`	pocketbase (first boot), api	Initial PocketBase admin account; the API uses it to read/write
`PB_ENCRYPTION_KEY`	pocketbase	32+ random chars; encrypts settings at rest
`SMTP_HOST` / `SMTP_PORT` / `SMTP_USER` / `SMTP_PASSWORD`	api	Transactional email (587 = STARTTLS, 465 = SSL)
`MAIL_FROM` / `MAIL_REPLY_TO`	api	Optional sender identity overrides
`ADMIN_EMAILS`	api	Optional comma-separated notification recipients
`CORS_ORIGIN`	api	Default `*`

Deploying to a VPS with Coolify

Push this repo to GitHub. .gitignore already excludes secrets, node_modules, build output, the PocketBase binary and its database.
In Coolify: New Resource → from GitHub repo → Docker Compose build pack (uses the root docker-compose.yml).
Set the environment variables above in Coolify's UI.
Expose the web service (container port 80) with your domain. It serves the site and reverse-proxies same-origin paths the frontend depends on:
- /hcgi/api/* → api:3001 (Express)
- /hcgi/platform/* → pocketbase:8090 (admin UI at https://your-domain/hcgi/platform/_/)
The pocketbase-data volume persists the database. On first boot, migrations build the schema and seed the admin account from the env vars.

Notes

apps/pocketbase/pb_migrations is append-only history — never edit or delete applied migrations; add new ones instead.
The PocketBase Dockerfile uses Docker's TARGETARCH, so arm64 VPSes work too.
Building the frontend image needs ~2 GB RAM on the VPS.
Assessment emails are sent only by the Express API (Nodemailer); PocketBase ships with an empty hooks directory in production.