From dab37a88e8ccd93c5946f161eed3d9c6342cea1c Mon Sep 17 00:00:00 2001
From: Alex Blank <alexblank@fastmail.com>
Date: Sat, 16 May 2026 11:50:39 +0000
Subject: [PATCH] refactor(docker): replace env_file with explicit environment
 variables

- Remove env_file references from docker-compose.yml and docker-compose.prod.yml
- Add explicit environment variable forwarding for all services
- Use TRAEFIK_NETWORK env var in docker-compose.traefik.yml instead of hardcoded name
- Add VITE_* frontend variables to .env.example and deploy/.env.example
- Add missing production variables (TRAEFIK_ENTRYPOINT, TRAEFIK_CERT_RESOLVER) to deploy/.env.example

This makes environment configuration more explicit and easier to manage
across different deployment scenarios (local dev, CI/CD, Portainer).
---
 .env.example               |  5 +++++
 deploy/.env.example        |  8 ++++++++
 docker-compose.prod.yml    | 17 +++++++++++++----
 docker-compose.traefik.yml |  1 +
 docker-compose.yml         | 12 ++++++++++--
 5 files changed, 37 insertions(+), 6 deletions(-)

diff --git a/.env.example b/.env.example
index 9de3464..436acbf 100644
--- a/.env.example
+++ b/.env.example
@@ -27,6 +27,11 @@ TRAEFIK_ENTRYPOINT=websecure
 TRAEFIK_CERT_RESOLVER=letsencrypt
 TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost
 
+# Frontend build-time variables (passed to web container)
+VITE_API_URL=http://localhost:8000
+VITE_OIDC_ISSUER=https://auth.example.com/application/o/headquarter/
+VITE_OIDC_CLIENT_ID=your-client-id
+
 # Secrets (generate strong random values for production)
 SECRET_ENCRYPTION_KEY=change-me-in-production
 
diff --git a/deploy/.env.example b/deploy/.env.example
index 2a4a7df..c729bcb 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -20,8 +20,16 @@ SECRET_ENCRYPTION_KEY=change-me-in-production
 ACCESS_TOKEN_EXPIRE_MINUTES=60
 
 # Deployment
+TRAEFIK_NETWORK=traefik
 TRAEFIK_LOG_LEVEL=INFO
+TRAEFIK_ENTRYPOINT=websecure
+TRAEFIK_CERT_RESOLVER=letsencrypt
 API_TAG=latest
 WEB_TAG=latest
 REGISTRY=ghcr.io
 REPO=headquarter
+
+# Frontend build-time variables
+VITE_API_URL=https://api.example.com
+VITE_OIDC_ISSUER=https://auth.example.com/application/o/headquarter/
+VITE_OIDC_CLIENT_ID=headquarter-web
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 4a12439..c240ddb 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -41,11 +41,18 @@ services:
     build:
       context: ./apps/api
       dockerfile: Dockerfile
-    env_file:
-      - .env
     environment:
       - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
       - ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
+      - TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
+      - API_URL=${API_URL:-http://localhost:8000}
+      - WEB_URL=${WEB_URL:-http://localhost:5173}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
+      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
+      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
+      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
+      - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
     depends_on:
       db:
         condition: service_healthy
@@ -72,8 +79,10 @@ services:
     build:
       context: ./apps/web
       dockerfile: Dockerfile
-    env_file:
-      - apps/web/.env
+    environment:
+      - VITE_API_URL=${VITE_API_URL:-http://localhost:8000}
+      - VITE_OIDC_ISSUER=${VITE_OIDC_ISSUER}
+      - VITE_OIDC_CLIENT_ID=${VITE_OIDC_CLIENT_ID}
     depends_on:
       - api
     networks:
diff --git a/docker-compose.traefik.yml b/docker-compose.traefik.yml
index ce22cf0..68e62f0 100644
--- a/docker-compose.traefik.yml
+++ b/docker-compose.traefik.yml
@@ -23,4 +23,5 @@ services:
 
 networks:
   traefik:
+    name: ${TRAEFIK_NETWORK:-traefik}
     external: true
diff --git a/docker-compose.yml b/docker-compose.yml
index 076d25f..f8f1e21 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,10 +5,18 @@ services:
       dockerfile: Dockerfile
     ports:
       - "8000:8000"
-    env_file:
-      - .env
     environment:
       - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-headquarter}
+      - ROOT_DOMAIN=${ROOT_DOMAIN:-localhost}
+      - TOOL_DOMAIN=${TOOL_DOMAIN:-tools.localhost}
+      - API_URL=${API_URL:-http://localhost:8000}
+      - WEB_URL=${WEB_URL:-http://localhost:5173}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
+      - AUTHENTIK_ISSUER_URL=${AUTHENTIK_ISSUER_URL}
+      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
+      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
+      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY:-change-me-in-production}
+      - AUTH_DEV_BYPASS=${AUTH_DEV_BYPASS:-false}
     depends_on:
       db:
         condition: service_healthy