refactor(docker): replace env_file with explicit environment variables

- Remove env_file references from docker-compose.yml and docker-compose.prod.yml
- Add explicit environment variable forwarding for all services
- Use TRAEFIK_NETWORK env var in docker-compose.traefik.yml instead of hardcoded name
- Add VITE_* frontend variables to .env.example and deploy/.env.example
- Add missing production variables (TRAEFIK_ENTRYPOINT, TRAEFIK_CERT_RESOLVER) to deploy/.env.example

This makes environment configuration more explicit and easier to manage
across different deployment scenarios (local dev, CI/CD, Portainer).

.env.example

@@ -27,6 +27,11 @@ TRAEFIK_ENTRYPOINT=websecure
 TRAEFIK_CERT_RESOLVER=letsencrypt
 TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost
 
+# Frontend build-time variables (passed to web container)
+VITE_API_URL=http://localhost:8000
+VITE_OIDC_ISSUER=https://auth.example.com/application/o/headquarter/
+VITE_OIDC_CLIENT_ID=your-client-id
+
 # Secrets (generate strong random values for production)
 SECRET_ENCRYPTION_KEY=change-me-in-production
 

deploy/.env.example

@@ -20,8 +20,16 @@ SECRET_ENCRYPTION_KEY=change-me-in-production
 ACCESS_TOKEN_EXPIRE_MINUTES=60
 
 # Deployment
+TRAEFIK_NETWORK=traefik
 TRAEFIK_LOG_LEVEL=INFO
+TRAEFIK_ENTRYPOINT=websecure
+TRAEFIK_CERT_RESOLVER=letsencrypt
 API_TAG=latest
 WEB_TAG=latest
 REGISTRY=ghcr.io
 REPO=headquarter
+
+# Frontend build-time variables
+VITE_API_URL=https://api.example.com
+VITE_OIDC_ISSUER=https://auth.example.com/application/o/headquarter/
+VITE_OIDC_CLIENT_ID=headquarter-web

docker-compose.prod.yml

@@ -41,11 +41,18 @@ services:
     build:
       context: ./apps/api
       dockerfile: Dockerfile
-    env_file:
-      - .env
     environment:
       - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
       - ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
+      - TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
+      - API_URL=${API_URL:-http://localhost:8000}
+      - WEB_URL=${WEB_URL:-http://localhost:5173}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
+      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
+      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
+      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
+      - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
     depends_on:
       db:
         condition: service_healthy
@@ -72,8 +79,10 @@ services:
     build:
       context: ./apps/web
       dockerfile: Dockerfile
-    env_file:
-      - apps/web/.env
+    environment:
+      - VITE_API_URL=${VITE_API_URL:-http://localhost:8000}
+      - VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
+      - VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
     depends_on:
       - api
     networks:

docker-compose.traefik.yml

@@ -23,4 +23,5 @@ services:
 
 networks:
   traefik:
+    name: ${TRAEFIK_NETWORK:-traefik}
     external: true

docker-compose.yml

@@ -5,10 +5,18 @@ services:
       dockerfile: Dockerfile
     ports:
       - "8000:8000"
-    env_file:
-      - .env
     environment:
       - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
+      - ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
+      - TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
+      - API_URL=${API_URL:-http://localhost:8000}
+      - WEB_URL=${WEB_URL:-http://localhost:5173}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
+      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
+      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
+      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
+      - AUTH_DEV_BYPASS=${AUTH_DEV_BYPASS:-false}
     depends_on:
       db:
         condition: service_healthy