chore: phase 0 reproducible docker/dev setup with version pinning

docker-compose.yml

@@ -14,8 +14,11 @@ services:
     env_file:
       - .env
     volumes:
+      # No venv volume by design: the venv lives at /opt/venv (image-local,
+      # see backend/Dockerfile). A named volume here used to shadow the image
+      # content with an empty dir on first start (split-brain with the host
+      # checkout, plus root-owned interpreters).
       - .:/srv/kirche-einfach
-      - kirche-venv:/srv/kirche-einfach/backend/.venv
     ports:
       - "8000:8000" # FastAPI
     depends_on:
@@ -45,8 +48,10 @@ services:
       # Dev default (HMR); prod .env sets `preview` (build + serve bundle).
       FRONTEND_MODE: ${FRONTEND_MODE:-dev}
     volumes:
+      # No node_modules volume by design: deps live in the bind-mount and the
+      # entrypoint runs `npm ci` on first start (a volume used to shadow the
+      # image install with an empty dir and diverge from the host checkout).
       - .:/srv/kirche-einfach
-      - kirche-node-modules:/srv/kirche-einfach/frontend/node_modules
     ports:
       - "3000:3000" # Vite
     depends_on:
@@ -55,7 +60,10 @@ services:
     restart: unless-stopped
 
   langflow:
-    image: langflowai/langflow:latest
+    # Pinned (never :latest): Langflow and LFX are versioned together, their
+    # major.minor must match. Bump via LANGFLOW_VERSION in .env (see
+    # .env.example) together with Dockerfile.lfx + backend `lfx~=` pin.
+    image: langflowai/langflow:${LANGFLOW_VERSION:-1.12.0}
     env_file:
       - .env
     environment:
@@ -68,12 +76,17 @@ services:
       # SQLite file inside the langflow-data volume (absolute path required
       # by Langflow); overrides any postgres URL that may linger in .env.
       LANGFLOW_DATABASE_URL: sqlite:////app/langflow/langflow.db
+      # Custom form-input components (backend/components, category folders).
+      LANGFLOW_COMPONENTS_PATH: /app/components
+      # Seed the authoring UI with the canonical flows (read-only: the files
+      # stay the source of truth, the API watcher is the only sync path).
+      LANGFLOW_LOAD_FLOWS_PATH: /app/flows
     volumes:
       - langflow-data:/app/langflow
+      - ./backend/components:/app/components:ro
+      - ./backend/flows:/app/flows:ro
     ports:
       - "7860:7860"
-    labels:
-      com.centurylinklabs.watchtower.enable: "true"
     restart: unless-stopped
     healthcheck:
       test:
@@ -110,6 +123,8 @@ services:
 
   # Nightly auto-updates of :latest images (prod). Never started in dev
   # (not in devcontainer.json runServices; also needs a docker socket).
+  # langflow/lfx carry no watchtower label on purpose: both are version-pinned
+  # (major.minor must match) and update only via deliberate version bumps.
   watchtower:
     image: nickfedor/watchtower:latest
     volumes:
@@ -124,7 +139,5 @@ services:
     restart: unless-stopped
 
 volumes:
-  kirche-venv:
-  kirche-node-modules:
   langflow-data:
   lfx-data: