From 1f2017b7a93463710634812954876b8a7e15dc29 Mon Sep 17 00:00:00 2001 From: Alex Blank Date: Sat, 16 May 2026 12:05:43 +0000 Subject: [PATCH] refactor(docker): remove all .env file references and add configurable Traefik vars - Remove env_file from deploy/portainer-stack.yml (api and web services) - Add TRAEFIK_CERT_RESOLVER env var to all Traefik router labels - Add TRAEFIK_DASHBOARD_SUBDOMAIN for configurable dashboard hostname - Add TRAEFIK_ENTRYPOINT env var to Traefik dashboard router - Update .env.example with TRAEFIK_DASHBOARD_SUBDOMAIN and TRAEFIK_LOG_LEVEL - Update deploy/.env.example with new Traefik variables All environment variables now come from host environment only. --- .env.example | 2 ++ deploy/.env.example | 1 + deploy/portainer-stack.yml | 26 +++++++++++++++++--------- docker-compose.prod.yml | 10 +++++----- 4 files changed, 25 insertions(+), 14 deletions(-) diff --git a/.env.example b/.env.example index 436acbf..e732614 100644 --- a/.env.example +++ b/.env.example @@ -25,6 +25,8 @@ AUTHENTIK_CLIENT_SECRET=your-client-secret TRAEFIK_NETWORK=traefik TRAEFIK_ENTRYPOINT=websecure TRAEFIK_CERT_RESOLVER=letsencrypt +TRAEFIK_DASHBOARD_SUBDOMAIN=traefik +TRAEFIK_LOG_LEVEL=INFO TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost # Frontend build-time variables (passed to web container) diff --git a/deploy/.env.example b/deploy/.env.example index c729bcb..504fd01 100644 --- a/deploy/.env.example +++ b/deploy/.env.example @@ -24,6 +24,7 @@ TRAEFIK_NETWORK=traefik TRAEFIK_LOG_LEVEL=INFO TRAEFIK_ENTRYPOINT=websecure TRAEFIK_CERT_RESOLVER=letsencrypt +TRAEFIK_DASHBOARD_SUBDOMAIN=traefik API_TAG=latest WEB_TAG=latest REGISTRY=ghcr.io diff --git a/deploy/portainer-stack.yml b/deploy/portainer-stack.yml index dbe2743..488602d 100644 --- a/deploy/portainer-stack.yml +++ b/deploy/portainer-stack.yml @@ -29,9 +29,9 @@ services: - tools labels: - traefik.enable=true - - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN}`) - - traefik.http.routers.traefik-dashboard.entrypoints=websecure - - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt + - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN}`) + - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure} + - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt} - traefik.http.routers.traefik-dashboard.service=api@internal - traefik.http.routers.traefik-dashboard.middlewares=auth@file restart: unless-stopped @@ -43,12 +43,18 @@ services: api: image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/api:${API_TAG:-latest} - env_file: - - stack.env environment: - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB} - ROOT_DOMAIN=${ROOT_DOMAIN} + - TOOL_DOMAIN=${TOOL_DOMAIN} + - API_URL=${API_URL} + - WEB_URL=${WEB_URL} - CORS_ORIGINS=https://${ROOT_DOMAIN},https://*.${ROOT_DOMAIN} + - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL} + - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID} + - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET} + - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY} + - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES} depends_on: db: condition: service_healthy @@ -60,7 +66,7 @@ services: - traefik.enable=true - traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN}`) - traefik.http.routers.api.entrypoints=websecure - - traefik.http.routers.api.tls.certresolver=letsencrypt + - traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt} - traefik.http.services.api.loadbalancer.server.port=8000 - traefik.http.routers.api.middlewares=sec-headers@file restart: unless-stopped @@ -73,8 +79,10 @@ services: web: image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/web:${WEB_TAG:-latest} - env_file: - - stack.env + environment: + - VITE_API_URL=${VITE_API_URL} + - VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER} + - VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID} depends_on: - api networks: @@ -83,7 +91,7 @@ services: - traefik.enable=true - traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN}`) - traefik.http.routers.web.entrypoints=websecure - - traefik.http.routers.web.tls.certresolver=letsencrypt + - traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt} - traefik.http.services.web.loadbalancer.server.port=8080 - traefik.http.routers.web.middlewares=sec-headers@file restart: unless-stopped diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index c240ddb..65a0d52 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -25,9 +25,9 @@ services: - tools labels: - traefik.enable=true - - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN:-localhost}`) - - traefik.http.routers.traefik-dashboard.entrypoints=websecure - - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt + - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN:-localhost}`) + - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure} + - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt} - traefik.http.routers.traefik-dashboard.service=api@internal - traefik.http.routers.traefik-dashboard.middlewares=auth@file restart: unless-stopped @@ -64,7 +64,7 @@ services: - traefik.enable=true - traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN:-localhost}`) - traefik.http.routers.api.entrypoints=websecure - - traefik.http.routers.api.tls.certresolver=letsencrypt + - traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt} - traefik.http.services.api.loadbalancer.server.port=8000 - traefik.http.routers.api.middlewares=sec-headers@file restart: unless-stopped @@ -91,7 +91,7 @@ services: - traefik.enable=true - traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN:-localhost}`) - traefik.http.routers.web.entrypoints=websecure - - traefik.http.routers.web.tls.certresolver=letsencrypt + - traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt} - traefik.http.services.web.loadbalancer.server.port=8080 - traefik.http.routers.web.middlewares=sec-headers@file restart: unless-stopped