refactor: separate MariaDB and Redis into independent Coolify resources

.env.coolify.example

@@ -2,11 +2,25 @@
 # Coolify Environment Variables — ClinicPro (Docker Compose)
 # ------------------------------------------------------------
 # Copy these into the Coolify resource's "Environment Variables" tab.
-# Only the variables referenced as ${...} in docker-compose.yml
-# need to be set here. DATABASE_URL / MESSENGER_TRANSPORT_DSN / REDIS_URL
-# are built INSIDE the compose file from the mariadb/redis service names.
+# Only the variables referenced as ${...} in docker-compose.yml need to be set.
+#
+# MariaDB and Redis are SEPARATE Coolify Database Resources (not in the compose).
+# So DATABASE_URL / REDIS_URL / MESSENGER_TRANSPORT_DSN must be set HERE, pointing
+# at those resources by their internal hostname (mariadb-<uuid> / redis-<uuid>).
+# Steps:
+#   1. Create a standalone MariaDB 11.8 resource + a standalone Redis resource.
+#   2. Enable "Connect to Predefined Network" on this app stack.
+#   3. Copy each resource's internal hostname/credentials into the URLs below.
 # ============================================================
 
+# ── Database / Redis connections (point at the SEPARATE Coolify resources) ──
+# Replace mariadb-XXXXXXXX / redis-XXXXXXXX with the real hostname shown on each
+# resource's page (Internal URL). serverVersion MUST match the MariaDB resource (11.8).
+DATABASE_URL="mysql://clinic:DB_PASSWORD@mariadb-XXXXXXXX:3306/clinic_pro?serverVersion=mariadb-11.8.0&charset=utf8mb4"
+REDIS_URL="redis://redis-XXXXXXXX:6379"
+MESSENGER_TRANSPORT_DSN="redis://redis-XXXXXXXX:6379/messages"
+# If the Redis resource has a password: redis://:PASSWORD@redis-XXXXXXXX:6379
+
 # ── Backend's own domain (single URL — used for payment callbacks & absolute URLs) ──
 # This is the API host, NOT a frontend domain.
 APP_BASE_URL=https://api.nobat724.com
@@ -24,11 +38,12 @@ CORS_ALLOW_ORIGIN='^https://(ahvaz\-nobat\.ir|arak\-nobat\.ir|ardabil\-nobat\.ir
 # ── Secrets (REQUIRED — set before the first deploy) ──
 APP_SECRET=            # php -r "echo bin2hex(random_bytes(32));"
 JWT_PASSPHRASE=        # openssl rand -hex 32   (must exist before first start: JWT keypair is generated with it)
-DB_PASSWORD=           # application DB user password
-DB_ROOT_PASSWORD=      # MariaDB root password
+
+# NOTE: DB_PASSWORD / DB_ROOT_PASSWORD are NO LONGER set here. The DB credentials
+# now belong to the standalone MariaDB resource — set them when you create that
+# resource, then embed the user password inside DATABASE_URL above.
 
 # Tip: in Coolify you may use magic vars instead of hardcoding, e.g.
-#   DB_PASSWORD=${SERVICE_PASSWORD_DB}
 #   APP_SECRET=${SERVICE_HEX_APPSECRET}
 
 # ── Reverse proxy (Coolify/Traefik) ──
@@ -44,3 +59,4 @@ API_IR_TOKEN=
 # • SMS keys (kavenegar/rangineh) and payment gateway keys (mellat/sep) are read
 #   from the DB ("Site Settings"), NOT from env. No need to set them here.
 # • REFRESH_TOKEN_TTL / OTP_TTL / MAX_FILE_SIZE_BYTES are fixed in the compose file.
+# • MariaDB & Redis are separate Coolify resources — see DATABASE_URL/REDIS_URL above.