## Context

Phase 4 built the admin (Docker Laravel + Filament on .27:3030). Phase 7 deployed the frontend to .13 (systemd service, port 3020, firewall opened). The Caddy block for `admin.where-woof.com` → `.13:3030` has been on .35 since Phase 7, and the user has now added the `admin` + `www.admin` A records. Phase 8 replicates the dev Docker setup on .13.

## Goals / Non-Goals

**Goals:**
- Admin live on .13:3030 via the same Docker pattern as dev.
- Connects to the shared Postgres (already on .13 — `localhost:5434` from .13).
- `admin.where-woof.com` reachable through Caddy once DNS propagates.

**Non-Goals:**
- New features (Phase 5+).
- HTTPS specifics (Caddy handles; cert issuance will work once the A record propagates — until then Caddy logs cert errors but serves HTTP).

## Decisions

1. **Replicate the .27 Docker setup on .13** — copy `admin/Dockerfile` + `docker-compose.yml` + `app/` (source only) to `/home/sam/Docker/Containers/wherewoof-admin/` on .13 (the established Docker location there — wherewoof-db, omniroute etc.). Build the image on .13 (php:8.3-cli + pdo_pgsql/intl/gd/zip — same Dockerfile), `composer install` via the container.
2. **`.env` on .13**: `DB_HOST=192.168.20.13` `DB_PORT=5434` (the published port is LAN-reachable — proven from .27); APP_KEY generated on .13; SESSION_DRIVER=file. Secrets stay out of the repo.
3. **No re-seed**: the admin user lives in the shared DB and is already there.
4. **Firewall**: `.13` needs `networking.firewall.allowedTCPPorts = [3030]` added (same as 3020) — user NixOS step, flagged.
5. **Restart policy**: compose `restart: unless-stopped` (unlike dev) so it survives reboots.

## Risks / Trade-offs

- [Image build time on .13] → one-time; Docker layer cache after.
- [DNS not yet propagated] → cert issuance for admin.where-woof.com may fail initially (Caddy logs it); it auto-retries — non-blocking.
- [Same DB, two admin instances (dev + live)] → fine; both read/write the shared DB; only the live one is public.

## Migration Plan

1. rsync admin source → .13 (exclude vendor/node_modules/.env/storage logs).
2. Build image + composer install on .13.
3. Write .env + `docker compose up -d` (port 3030, restart unless-stopped).
4. Verify localhost:3030 on .13; firewall 3030 (user); then Caddy path once DNS propagates.

## Open Questions

- None blocking.
