rmancinasandClaude Opus 5
683fd37b08
The swarm stack still hard-failed on an unset API_ORIGIN, and both the env template and the README told the reader to pin it — the exact habit the derived origin was meant to end. Make it an optional override everywhere, and say that WEB_ORIGIN is now a list. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
75 lines
3.6 KiB
Bash
75 lines
3.6 KiB
Bash
# Stack env for deploy/jorgecuadros-app.stack.yml (PROD).
|
|
# Paste these into the Portainer stack's "Environment variables" at deploy time.
|
|
# Do NOT commit real secrets — this file is a template only.
|
|
#
|
|
# HOST below = the swarm host the db/minio/app stacks publish on (cubex).
|
|
|
|
# Which built image tag to run. latest = default-branch build; or pin sha-<x> / vX.Y.Z.
|
|
APP_TAG=latest
|
|
|
|
# --- Public URLs (what the end user's BROWSER hits) ---------------------------
|
|
# API_ORIGIN is OPTIONAL and normally left unset. The browser derives the API
|
|
# origin from the page it loaded (apps/web/src/lib/api.ts): same host on port
|
|
# 3001 over plain HTTP, or the same-origin /api path when the page is served
|
|
# over https by a TLS-terminating proxy that maps /api to the API. That is what
|
|
# lets the same deployment move — tailnet, office LAN, demo domain — untouched.
|
|
# Set it only when the API genuinely lives on a different host than the web app;
|
|
# it is used for browser fetches AND document download links, so it must be
|
|
# browser-reachable (never a swarm-internal name).
|
|
#API_ORIGIN=http://192.168.4.212:3001
|
|
#
|
|
# WEB_ORIGIN is the list of public origins the web app is reached under; the API
|
|
# allows them via CORS. COMMA-SEPARATED — one deployment is reachable under
|
|
# several origins (LAN IP, tailnet name, demo domain) and a credentialed fetch
|
|
# from an origin missing here gets no CORS headers and fails. A same-origin
|
|
# setup (web + API behind one proxy) never hits CORS at all.
|
|
WEB_ORIGIN=http://192.168.4.212:3000
|
|
|
|
# Published ports on the swarm host.
|
|
API_PORT=3001
|
|
WEB_PORT=3000
|
|
|
|
# --- Database (points at the jorgecuadros-prod-db stack) ----------------------
|
|
# prod db publishes 3306 on the host (see deploy/jorgecuadros-db.stack.yml).
|
|
DATABASE_URL=mysql://jorgecuadros:CHANGE_ME@192.168.4.212:3306/jorgecuadros
|
|
|
|
# --- Auth --------------------------------------------------------------------
|
|
# 64-hex random. Generate: openssl rand -hex 32
|
|
SESSION_SECRET=CHANGE_ME
|
|
|
|
# --- Object storage (points at the jorgecuadros-prod-minio stack) -------------
|
|
# Server-side only; prod minio API publishes 9000 on the host.
|
|
S3_ENDPOINT=http://192.168.4.212:9000
|
|
S3_BUCKET=jorgecuadros-documents
|
|
MINIO_ROOT_USER=jc_minio
|
|
MINIO_ROOT_PASSWORD=CHANGE_ME
|
|
|
|
# --- Outbound mail (Amazon SES) ----------------------------------------------
|
|
# NOTE: for the Portainer-deployed stacks these do NOT come from a file on the
|
|
# host — the deploy workflows build the stack env from Gitea repo secrets (see
|
|
# the `env_data` blocks in .gitea/workflows/deploy*.yml). This file documents
|
|
# the full variable set and is what you fill in for a hand-run stack.
|
|
#
|
|
# Either way they are RUNTIME config, read at container boot
|
|
# (apps/api/src/mail/mail.service.ts) — never baked into the image.
|
|
#
|
|
# The production image sets NODE_ENV=production, which turns OFF the stdout dev
|
|
# fallback. Leaving these blank does not silently swallow mail — every send
|
|
# fails with "El envío de correo no está configurado.", and the failure is
|
|
# recorded in the notification log. Fill them in before enabling any envío.
|
|
#
|
|
# SES_FROM must be a verified SES sending identity.
|
|
SES_REGION=us-west-2
|
|
SES_FROM=mail@jorgecuadros.com
|
|
SES_FROM_NAME=Information Server
|
|
SES_ACCESS_KEY=
|
|
SES_SECRET_KEY=
|
|
# Optional — only needed to publish bounce/complaint events.
|
|
SES_CONFIGURATION_SET=
|
|
|
|
# Recipients of the per-job summary email. NOW EDITABLE IN THE UI
|
|
# (/notificaciones > Servicios > "Destinatarios del resumen", ADMIN only), so
|
|
# this is only the fallback for a deployment where nobody has set it there.
|
|
# A saved value takes precedence and this var is ignored from then on.
|
|
NOTIFICATION_ADMIN_EMAILS=rmancinas@freakma.net,mpulido@freakma.net
|