refactor(docker): remove all .env file references and add configurable Traefik vars

- Remove env_file from deploy/portainer-stack.yml (api and web services)
- Add TRAEFIK_CERT_RESOLVER env var to all Traefik router labels
- Add TRAEFIK_DASHBOARD_SUBDOMAIN for configurable dashboard hostname
- Add TRAEFIK_ENTRYPOINT env var to Traefik dashboard router
- Update .env.example with TRAEFIK_DASHBOARD_SUBDOMAIN and TRAEFIK_LOG_LEVEL
- Update deploy/.env.example with new Traefik variables

All environment variables now come from host environment only.

.env.example

@@ -25,6 +25,8 @@ AUTHENTIK_CLIENT_SECRET=your-client-secret
 TRAEFIK_NETWORK=traefik
 TRAEFIK_ENTRYPOINT=websecure
 TRAEFIK_CERT_RESOLVER=letsencrypt
+TRAEFIK_DASHBOARD_SUBDOMAIN=traefik
+TRAEFIK_LOG_LEVEL=INFO
 TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost
 
 # Frontend build-time variables (passed to web container)

deploy/.env.example

@@ -24,6 +24,7 @@ TRAEFIK_NETWORK=traefik
 TRAEFIK_LOG_LEVEL=INFO
 TRAEFIK_ENTRYPOINT=websecure
 TRAEFIK_CERT_RESOLVER=letsencrypt
+TRAEFIK_DASHBOARD_SUBDOMAIN=traefik
 API_TAG=latest
 WEB_TAG=latest
 REGISTRY=ghcr.io

deploy/portainer-stack.yml

@@ -29,9 +29,9 @@ services:
       - tools
     labels:
       - traefik.enable=true
-      - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN}`)
+      - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN}`)
-      - traefik.http.routers.traefik-dashboard.entrypoints=websecure
+      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
-      - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.routers.traefik-dashboard.service=api@internal
       - traefik.http.routers.traefik-dashboard.middlewares=auth@file
     restart: unless-stopped
@@ -43,12 +43,18 @@ services:
 
   api:
     image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/api:${API_TAG:-latest}
-    env_file:
-      - stack.env
     environment:
       - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
       - ROOT_DOMAIN=${ROOT_DOMAIN}
+      - TOOL_DOMAIN=${TOOL_DOMAIN}
+      - API_URL=${API_URL}
+      - WEB_URL=${WEB_URL}
       - CORS_ORIGINS=https://${ROOT_DOMAIN},https://*.${ROOT_DOMAIN}
+      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
+      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
+      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
+      - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES}
     depends_on:
       db:
         condition: service_healthy
@@ -60,7 +66,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN}`)
       - traefik.http.routers.api.entrypoints=websecure
-      - traefik.http.routers.api.tls.certresolver=letsencrypt
+      - traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.api.loadbalancer.server.port=8000
       - traefik.http.routers.api.middlewares=sec-headers@file
     restart: unless-stopped
@@ -73,8 +79,10 @@ services:
 
   web:
     image: ${REGISTRY:-ghcr.io}/${REPO:-headquarter}/web:${WEB_TAG:-latest}
-    env_file:
+    environment:
-      - stack.env
+      - VITE_API_URL=${VITE_API_URL}
+      - VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
+      - VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
     depends_on:
       - api
     networks:
@@ -83,7 +91,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN}`)
       - traefik.http.routers.web.entrypoints=websecure
-      - traefik.http.routers.web.tls.certresolver=letsencrypt
+      - traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.web.loadbalancer.server.port=8080
       - traefik.http.routers.web.middlewares=sec-headers@file
     restart: unless-stopped

docker-compose.prod.yml

@@ -25,9 +25,9 @@ services:
       - tools
     labels:
       - traefik.enable=true
-      - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${ROOT_DOMAIN:-localhost}`)
+      - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_SUBDOMAIN:-traefik}.${ROOT_DOMAIN:-localhost}`)
-      - traefik.http.routers.traefik-dashboard.entrypoints=websecure
+      - traefik.http.routers.traefik-dashboard.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
-      - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.traefik-dashboard.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.routers.traefik-dashboard.service=api@internal
       - traefik.http.routers.traefik-dashboard.middlewares=auth@file
     restart: unless-stopped
@@ -64,7 +64,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.api.rule=Host(`api.${ROOT_DOMAIN:-localhost}`)
       - traefik.http.routers.api.entrypoints=websecure
-      - traefik.http.routers.api.tls.certresolver=letsencrypt
+      - traefik.http.routers.api.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.api.loadbalancer.server.port=8000
       - traefik.http.routers.api.middlewares=sec-headers@file
     restart: unless-stopped
@@ -91,7 +91,7 @@ services:
       - traefik.enable=true
       - traefik.http.routers.web.rule=Host(`${ROOT_DOMAIN:-localhost}`)
       - traefik.http.routers.web.entrypoints=websecure
-      - traefik.http.routers.web.tls.certresolver=letsencrypt
+      - traefik.http.routers.web.tls.certresolver=${TRAEFIK_CERT_RESOLVER:-letsencrypt}
       - traefik.http.services.web.loadbalancer.server.port=8080
       - traefik.http.routers.web.middlewares=sec-headers@file
     restart: unless-stopped