Permanently eliminate the "$X variable not set" warning, and fix Caddy auto-HTTPS on private IPs

Two separate leaks were causing the same cosmetic-but-annoying warning to
survive every previous fix attempt:

1. Compose's own `secrets:` block reads the referenced file's *content*
   as part of its config model, and applies the same interpolation
   warning to it — even with DB_PASSWORD fully removed from every ${VAR}
   and --env-file path. Switched from Compose's native `secrets:` to plain
   bind mounts at the same /run/secrets/* paths: a bind mount only ever
   touches the file's path, never its content, so it's immune. (Verified
   this precisely with an isolated repro before rolling it out — the two
   mechanisms behave differently even though they look equivalent.)

2. caddy's `env_file: .env.staging` (a leftover from the since-removed
   basic-auth setup) loaded the *raw*, unfiltered env file directly,
   bypassing deploy.sh/backup.sh/restore.sh's filtered-copy mechanism
   entirely. Caddy only ever needed SITE_DOMAIN; switched to passing that
   one value directly instead of the whole file.

Also fixed Caddyfile.staging: the site address had no explicit scheme, so
Caddy's automatic-HTTPS logic still applied to a private IP (registering
its own internal CA and redirecting HTTP->HTTPS) — not the "plain HTTP
only" behavior I'd assumed and told the user earlier. Prefixed with
`http://` to genuinely disable automatic HTTPS for this LAN-only box.

Verified end-to-end: fresh deploy with dollar-sign DB passwords produces
zero warnings, serves HTTP 200 on plain http:// with no redirect, and the
DB connection genuinely authenticates.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/backup.sh

@@ -19,7 +19,14 @@ BACKUP_RETENTION_DAYS="$(env_get "$ENV_FILE" BACKUP_RETENTION_DAYS)"
 BACKUP_DIR="${BACKUP_DIR:-./backups}/${ENVIRONMENT}"
 mkdir -p "$BACKUP_DIR"
 
-COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+# See deploy.sh for why: Compose warns on any $-shaped value in --env-file
+# even when unused, so DB_PASSWORD/DB_ROOT_PASSWORD are filtered out of the
+# copy Compose actually sees.
+COMPOSE_ENV_FILE="$(mktemp)"
+trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
+grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"
+
+COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${COMPOSE_ENV_FILE}"
 
 echo "==> dumping database"
 $COMPOSE exec -T db sh -c "exec mariadb-dump -u\"\$MARIADB_USER\" -p\"\$(cat /run/secrets/db_password)\" \"\$MARIADB_DATABASE\"" \

deploy/deploy.sh

@@ -28,10 +28,22 @@ WP_ADMIN_USER="$(env_get "$ENV_FILE" WP_ADMIN_USER)"
 WP_ADMIN_PASSWORD="$(env_get "$ENV_FILE" WP_ADMIN_PASSWORD)"
 WP_ADMIN_EMAIL="$(env_get "$ENV_FILE" WP_ADMIN_EMAIL)"
 
+# DB_PASSWORD/DB_ROOT_PASSWORD are stripped from what Compose itself loads:
+# Compose scans every value in --env-file for $identifier-looking patterns
+# as part of building its own interpolation table, and warns "variable not
+# set" for any it finds — even though nothing consumes these two via ${VAR}
+# anymore (they only flow through secrets/, via env_get below, which reads
+# the real, unfiltered $ENV_FILE directly). Filtering them out of Compose's
+# copy is what makes that warning actually go away, permanently, regardless
+# of what characters end up in either password.
+COMPOSE_ENV_FILE="$(mktemp)"
+trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
+grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"
+
 # -p pins the Compose project name to the environment (default is the
 # directory name, which every environment shares — that made staging quietly
 # reuse dev's db_data volume/credentials the first time this ran).
-COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
+COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${COMPOSE_ENV_FILE}"
 
 echo "==> writing DB secret files (bypasses compose's \${VAR} interpolation entirely)"
 SECRETS_DIR="secrets/${ENVIRONMENT}"

deploy/restore.sh

@@ -12,7 +12,14 @@ cd "$REPO_ROOT"
 ENV_FILE=".env.staging"
 export ENVIRONMENT=staging
 
-COMPOSE="docker compose -p bookstore-staging -f docker-compose.yml -f docker-compose.staging.yml --env-file ${ENV_FILE}"
+# See deploy.sh for why: Compose warns on any $-shaped value in --env-file
+# even when unused, so DB_PASSWORD/DB_ROOT_PASSWORD are filtered out of the
+# copy Compose actually sees.
+COMPOSE_ENV_FILE="$(mktemp)"
+trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
+grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"
+
+COMPOSE="docker compose -p bookstore-staging -f docker-compose.yml -f docker-compose.staging.yml --env-file ${COMPOSE_ENV_FILE}"
 
 echo "!! this OVERWRITES the staging database and uploads !!"
 read -r -p "type 'restore' to continue: " confirm