rmancinasandClaude Opus 5
f4b92fa7a5
The stack env is assembled from Gitea repo secrets by the deploy workflows' `env_data` block — there is no .env file on the host for the app stack. SES was in neither, so `MailService` came up unconfigured on every deployment and, with NODE_ENV=production killing the stdout dev fallback, every notification and renewal aviso failed. Wire SES_REGION / SES_FROM / SES_FROM_NAME / SES_ACCESS_KEY / SES_SECRET_KEY / SES_CONFIGURATION_SET / NOTIFICATION_ADMIN_EMAILS through both galactus and cubex. No `_GALACTUS` suffix: one SES identity serves every deployment. Kept out of the required-secrets preflight — mail is not needed to boot, and failing a deploy over it would be wrong. Preflight warns instead, since the failure is otherwise invisible until someone clicks "Ejecutar". Also corrects the comments added in the previous commit, which claimed these belonged in a host env file rather than in CI secrets. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
62 lines
2.7 KiB
Bash
62 lines
2.7 KiB
Bash
# Stack env for deploy/jorgecuadros-app.stack.yml (PROD).
|
|
# Paste these into the Portainer stack's "Environment variables" at deploy time.
|
|
# Do NOT commit real secrets — this file is a template only.
|
|
#
|
|
# HOST below = the swarm host the db/minio/app stacks publish on (cubex).
|
|
|
|
# Which built image tag to run. latest = default-branch build; or pin sha-<x> / vX.Y.Z.
|
|
APP_TAG=latest
|
|
|
|
# --- Public URLs (what the end user's BROWSER hits) ---------------------------
|
|
# API_ORIGIN is injected into the web app at runtime and used for browser fetches
|
|
# + document download links, so it must be browser-reachable (not swarm-internal).
|
|
# WEB_ORIGIN is the web app's own public origin; the API allows it via CORS.
|
|
API_ORIGIN=http://192.168.4.212:3001
|
|
WEB_ORIGIN=http://192.168.4.212:3000
|
|
|
|
# Published ports on the swarm host.
|
|
API_PORT=3001
|
|
WEB_PORT=3000
|
|
|
|
# --- Database (points at the jorgecuadros-prod-db stack) ----------------------
|
|
# prod db publishes 3306 on the host (see deploy/jorgecuadros-db.stack.yml).
|
|
DATABASE_URL=mysql://jorgecuadros:CHANGE_ME@192.168.4.212:3306/jorgecuadros
|
|
|
|
# --- Auth --------------------------------------------------------------------
|
|
# 64-hex random. Generate: openssl rand -hex 32
|
|
SESSION_SECRET=CHANGE_ME
|
|
|
|
# --- Object storage (points at the jorgecuadros-prod-minio stack) -------------
|
|
# Server-side only; prod minio API publishes 9000 on the host.
|
|
S3_ENDPOINT=http://192.168.4.212:9000
|
|
S3_BUCKET=jorgecuadros-documents
|
|
MINIO_ROOT_USER=jc_minio
|
|
MINIO_ROOT_PASSWORD=CHANGE_ME
|
|
|
|
# --- Outbound mail (Amazon SES) ----------------------------------------------
|
|
# NOTE: for the Portainer-deployed stacks these do NOT come from a file on the
|
|
# host — the deploy workflows build the stack env from Gitea repo secrets (see
|
|
# the `env_data` blocks in .gitea/workflows/deploy*.yml). This file documents
|
|
# the full variable set and is what you fill in for a hand-run stack.
|
|
#
|
|
# Either way they are RUNTIME config, read at container boot
|
|
# (apps/api/src/mail/mail.service.ts) — never baked into the image.
|
|
#
|
|
# The production image sets NODE_ENV=production, which turns OFF the stdout dev
|
|
# fallback. Leaving these blank does not silently swallow mail — every send
|
|
# fails with "El envío de correo no está configurado.", and the failure is
|
|
# recorded in the notification log. Fill them in before enabling any envío.
|
|
#
|
|
# SES_FROM must be a verified SES sending identity.
|
|
SES_REGION=us-west-2
|
|
SES_FROM=mail@jorgecuadros.com
|
|
SES_FROM_NAME=Information Server
|
|
SES_ACCESS_KEY=
|
|
SES_SECRET_KEY=
|
|
# Optional — only needed to publish bounce/complaint events.
|
|
SES_CONFIGURATION_SET=
|
|
|
|
# Recipients of the per-job summary email. Comma-separated; unset falls back to
|
|
# the defaults in NotificationsService.
|
|
NOTIFICATION_ADMIN_EMAILS=rmancinas@freakma.net,mpulido@freakma.net
|