ginnoir
7aa95fa00a
Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).
- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
on-host Portainer working-copy path (/config/portainer/compose/<id>)
Validated with docker compose config on valhalla for all 15 stacks.
39 lines
1.7 KiB
Bash
39 lines
1.7 KiB
Bash
# famapp stack secrets — injected into all services via env_file.
|
|
# Var names are exactly what each container reads (no ${VAR} interpolation,
|
|
# no Portainer UI env vars). POSTGRES_* (db) are embedded in DATABASE_URL
|
|
# (app) — keep them in sync on rotation. MINIO_ROOT_* are shared by the app
|
|
# and the minio server. Image tag is pinned in docker-compose.yml.
|
|
RUN_MIGRATIONS=true
|
|
LOG_LEVEL=info
|
|
|
|
AUTH_URL=https://fam.ginnoir.com
|
|
|
|
# postgres (db container) + the composed URL the app reads
|
|
POSTGRES_USER=famapp
|
|
POSTGRES_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24
|
|
POSTGRES_DB=famapp
|
|
DATABASE_URL=postgres://famapp:a9a999d16dd5cdc521bb62eff331265d3c24@famapp-db:5432/famapp
|
|
|
|
# famapp Auth.js session secret
|
|
AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
|
|
|
|
# OIDC via Authentik (public URL through Caddy — no container dependency)
|
|
AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/
|
|
AUTH_OIDC_CLIENT_ID=6uOZ8yjTR9Z2m1RZU1cLHYXHV2Lv6zZtfuJcrsdq
|
|
AUTH_OIDC_CLIENT_SECRET=CPcNM8jXaJ2jHFKxRwGuuKyMKJsT502l3FztO1AOcFqDzWqlWu5x7Ox52Q6zyBa2v33YzoA9igrXW8FFjd1Gp7wrZV4PGTwvXmOd7pIMOY93gNotAgJaewT8WHW1F3YD
|
|
|
|
VAPID_PUBLIC_KEY=BNED_UgfPhyoG6_JOabhpQpN3nr6QM5tO0PDiAadMGCcZROn8LM7tnsBrKaB1E5kfuDFb1rC_M86cT3uCvBqSBk
|
|
VAPID_PRIVATE_KEY=QyJiyCI2TJa_QWVXznfj4vjpWTBsyFfSCtn1brpE9aI
|
|
VAPID_SUBJECT=mailto:3nigma.matt@gmail.com
|
|
|
|
NTFY_URL=https://ntfy.ginnoir.com
|
|
NTFY_TOPIC=famapp
|
|
|
|
# MinIO object storage (plant/container image uploads)
|
|
MINIO_ROOT_USER=famapp
|
|
MINIO_ROOT_PASSWORD=d0fet0th3x
|
|
MINIO_BUCKET=garden
|
|
|
|
OPENPLANTBOOK_CLIENT_ID=5JdQLab69RhVaF4er7b7D29BCrkf3fo3OEiDsOQa
|
|
OPENPLANTBOOK_CLIENT_SECRET=kxPTrdQPAVta7sjVuIRf5EGIJ1fKvlMlqRSJpQtFxRftJhg7oeGnXzwH7ls6tluQLFUYVDYRMwISiAuKZGZLvkuJzUwFGCwhZw7UtW8OvcTGy4717WeNUinvuCDSsNXP
|