diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..efdba87
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+* text=auto
+*.sh text eol=lf
diff --git a/docker-compose.yml b/docker-compose.yml
index 0ac3696..89004d6 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,13 +3,12 @@ name: mc-cars
 ############################################################
 # MC Cars - fully Dockerized self-hosted Supabase + web
 #
-# Portability contract:
-#   - ALL runtime state lives under ./data (bind mounts).
-#   - ALL config lives under this folder (supabase/, frontend/, .env).
-#   - Copying the "MC Cars" folder to another host and running
-#       docker compose up -d
-#     reproduces the stack bit-for-bit. No named volumes, no
-#     absolute paths, no external dependencies.
+# Host deployment root:
+#   - ALL bind mounts resolve under /mnt/user/appdata/mc-cars.
+#   - Runtime state lives under /mnt/user/appdata/mc-cars/data.
+#   - Config lives under /mnt/user/appdata/mc-cars/{supabase,frontend}.
+#   - Deploy this stack from that host folder so Docker sees the same
+#     absolute paths on every restart.
 ############################################################
 
 networks:
@@ -43,9 +42,9 @@ services:
       POSTGRES_DB: ${POSTGRES_DB}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
     volumes:
-      - ./data/db:/var/lib/postgresql/data
-      - ./supabase/migrations/00-run-init.sh:/docker-entrypoint-initdb.d/00-run-init.sh:ro
-      - ./supabase/migrations/01-init.sql:/sql/01-init.sql:ro
+      - /mnt/user/appdata/mc-cars/data/db:/var/lib/postgresql/data
+      - /mnt/user/appdata/mc-cars/supabase/migrations/00-run-init.sh:/docker-entrypoint-initdb.d/00-run-init.sh:ro
+      - /mnt/user/appdata/mc-cars/supabase/migrations/01-init.sql:/sql/01-init.sql:ro
     ports:
       - "5432:5432"
     networks: [mccars]
@@ -140,7 +139,7 @@ services:
       ENABLE_IMAGE_TRANSFORMATION: "true"
       IMGPROXY_URL: http://imgproxy:5001
     volumes:
-      - ./data/storage:/var/lib/storage
+      - /mnt/user/appdata/mc-cars/data/storage:/var/lib/storage
     networks: [mccars]
     logging: { driver: json-file, options: { max-size: "10m", max-file: "3" } }
 
@@ -154,7 +153,7 @@ services:
       IMGPROXY_USE_ETAG: "true"
       IMGPROXY_ENABLE_WEBP_DETECTION: "true"
     volumes:
-      - ./data/storage:/var/lib/storage
+      - /mnt/user/appdata/mc-cars/data/storage:/var/lib/storage
     networks: [mccars]
 
   # -------------------------------------------------------------------------
@@ -208,8 +207,8 @@ services:
       ADMIN_EMAIL: ${ADMIN_EMAIL}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
     volumes:
-      - ./supabase/migrations/post-boot.sql:/sql/post-boot.sql:ro
-      - ./supabase/migrations/02-leads.sql:/sql/02-leads.sql:ro
+      - /mnt/user/appdata/mc-cars/supabase/migrations/post-boot.sql:/sql/post-boot.sql:ro
+      - /mnt/user/appdata/mc-cars/supabase/migrations/02-leads.sql:/sql/02-leads.sql:ro
     entrypoint: ["sh","-c"]
     command:
       - |
@@ -272,7 +271,7 @@ services:
       KONG_NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
       KONG_NGINX_PROXY_PROXY_BUFFERS: 64 160k
     volumes:
-      - ./supabase/kong.yml:/home/kong/kong.yml:ro
+      - /mnt/user/appdata/mc-cars/supabase/kong.yml:/home/kong/kong.yml:ro
     ports:
       - "54321:8000/tcp"
       - "54443:8443/tcp"
@@ -311,10 +310,10 @@ services:
 
   # -------------------------------------------------------------------------
   # Public website (nginx + static assets). Anon key injected at boot.
+  # No build step — Portainer-compatible (image + bind mounts).
   # -------------------------------------------------------------------------
   web:
-    build:
-      context: ./frontend
+    image: nginx:1.27-alpine
     container_name: mccars-web
     restart: unless-stopped
     depends_on:
@@ -322,6 +321,10 @@ services:
     environment:
       SUPABASE_URL: ${SUPABASE_PUBLIC_URL}
       SUPABASE_ANON_KEY: ${ANON_KEY}
+    volumes:
+      - /mnt/user/appdata/mc-cars/frontend:/usr/share/nginx/html:ro
+      - /mnt/user/appdata/mc-cars/frontend/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - /mnt/user/appdata/mc-cars/frontend/99-config.sh:/docker-entrypoint.d/99-config.sh:ro
     ports:
       - "8080:80"
     networks: [mccars]
diff --git a/frontend/99-config.sh b/frontend/99-config.sh
new file mode 100644
index 0000000..996cea1
--- /dev/null
+++ b/frontend/99-config.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+cat > /usr/share/nginx/html/config.js <<EOF
+window.MCCARS_CONFIG = {
+  SUPABASE_URL: "${SUPABASE_URL:-http://localhost:8000}",
+  SUPABASE_ANON_KEY: "${SUPABASE_ANON_KEY:-}"
+};
+EOF
+exec nginx -g "daemon off;"