ginnoir
7aa95fa00a
Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).
- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
on-host Portainer working-copy path (/config/portainer/compose/<id>)
Validated with docker compose config on valhalla for all 15 stacks.
25 lines
1004 B
Bash
25 lines
1004 B
Bash
# resume stack secrets — injected into all services via env_file.
|
|
# Var names are exactly what each container reads (no ${VAR} interpolation).
|
|
# Components are duplicated into composites (DATABASE_URL embeds
|
|
# POSTGRES_PASSWORD; STORAGE_* mirror MINIO_*) — keep them in sync on rotation.
|
|
|
|
# postgres
|
|
POSTGRES_PASSWORD=postgres
|
|
|
|
# minio (resume-minio service)
|
|
MINIO_ROOT_USER=minioadmin
|
|
MINIO_ROOT_PASSWORD=minioadmin
|
|
|
|
# browserless chrome auth token (chrome reads TOKEN, the app reads PRINTER_TOKEN)
|
|
TOKEN=chrome_token
|
|
PRINTER_TOKEN=chrome_token
|
|
|
|
# reactive-resume app
|
|
DATABASE_URL=postgresql://postgres:postgres@postgres:5432/postgres
|
|
STORAGE_ACCESS_KEY=minioadmin
|
|
STORAGE_SECRET_KEY=minioadmin
|
|
# Auth/JWT signing secret for Reactive Resume.
|
|
# Pinned to the running value so recreating the container keeps sessions valid.
|
|
# Rotate with: openssl rand -hex 64
|
|
AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
|