Permanently eliminate the "$X variable not set" warning, and fix Caddy auto-HTTPS on private IPs
Two separate leaks were causing the same cosmetic-but-annoying warning to
survive every previous fix attempt:
1. Compose's own `secrets:` block reads the referenced file's *content*
as part of its config model, and applies the same interpolation
warning to it — even with DB_PASSWORD fully removed from every ${VAR}
and --env-file path. Switched from Compose's native `secrets:` to plain
bind mounts at the same /run/secrets/* paths: a bind mount only ever
touches the file's path, never its content, so it's immune. (Verified
this precisely with an isolated repro before rolling it out — the two
mechanisms behave differently even though they look equivalent.)
2. caddy's `env_file: .env.staging` (a leftover from the since-removed
basic-auth setup) loaded the *raw*, unfiltered env file directly,
bypassing deploy.sh/backup.sh/restore.sh's filtered-copy mechanism
entirely. Caddy only ever needed SITE_DOMAIN; switched to passing that
one value directly instead of the whole file.
Also fixed Caddyfile.staging: the site address had no explicit scheme, so
Caddy's automatic-HTTPS logic still applied to a private IP (registering
its own internal CA and redirecting HTTP->HTTPS) — not the "plain HTTP
only" behavior I'd assumed and told the user earlier. Prefixed with
`http://` to genuinely disable automatic HTTPS for this LAN-only box.
Verified end-to-end: fresh deploy with dollar-sign DB passwords produces
zero warnings, serves HTTP 200 on plain http:// with no redirect, and the
DB connection genuinely authenticates.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
@@ -1,6 +1,12 @@
|
||||
ENV ?= dev
|
||||
export ENVIRONMENT = $(ENV)
|
||||
COMPOSE = docker compose -p bookstore-$(ENV) -f docker-compose.yml -f docker-compose.$(ENV).yml --env-file .env.$(ENV)
|
||||
# DB_PASSWORD/DB_ROOT_PASSWORD are stripped from what Compose loads — they
|
||||
# only flow through secrets/ now, and Compose warns "variable not set" on
|
||||
# any $-shaped value in --env-file even when nothing consumes it. Rewritten
|
||||
# fresh on every `make` invocation, so it can't drift from .env.$(ENV).
|
||||
COMPOSE_ENV_FILE := .env.$(ENV).compose
|
||||
$(shell grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' .env.$(ENV) > $(COMPOSE_ENV_FILE) 2>/dev/null)
|
||||
COMPOSE = docker compose -p bookstore-$(ENV) -f docker-compose.yml -f docker-compose.$(ENV).yml --env-file $(COMPOSE_ENV_FILE)
|
||||
|
||||
.PHONY: up down ps logs shell wp deploy backup
|
||||
|
||||
|
||||
+8
-1
@@ -19,7 +19,14 @@ BACKUP_RETENTION_DAYS="$(env_get "$ENV_FILE" BACKUP_RETENTION_DAYS)"
|
||||
BACKUP_DIR="${BACKUP_DIR:-./backups}/${ENVIRONMENT}"
|
||||
mkdir -p "$BACKUP_DIR"
|
||||
|
||||
COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
|
||||
# See deploy.sh for why: Compose warns on any $-shaped value in --env-file
|
||||
# even when unused, so DB_PASSWORD/DB_ROOT_PASSWORD are filtered out of the
|
||||
# copy Compose actually sees.
|
||||
COMPOSE_ENV_FILE="$(mktemp)"
|
||||
trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
|
||||
grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"
|
||||
|
||||
COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${COMPOSE_ENV_FILE}"
|
||||
|
||||
echo "==> dumping database"
|
||||
$COMPOSE exec -T db sh -c "exec mariadb-dump -u\"\$MARIADB_USER\" -p\"\$(cat /run/secrets/db_password)\" \"\$MARIADB_DATABASE\"" \
|
||||
|
||||
+13
-1
@@ -28,10 +28,22 @@ WP_ADMIN_USER="$(env_get "$ENV_FILE" WP_ADMIN_USER)"
|
||||
WP_ADMIN_PASSWORD="$(env_get "$ENV_FILE" WP_ADMIN_PASSWORD)"
|
||||
WP_ADMIN_EMAIL="$(env_get "$ENV_FILE" WP_ADMIN_EMAIL)"
|
||||
|
||||
# DB_PASSWORD/DB_ROOT_PASSWORD are stripped from what Compose itself loads:
|
||||
# Compose scans every value in --env-file for $identifier-looking patterns
|
||||
# as part of building its own interpolation table, and warns "variable not
|
||||
# set" for any it finds — even though nothing consumes these two via ${VAR}
|
||||
# anymore (they only flow through secrets/, via env_get below, which reads
|
||||
# the real, unfiltered $ENV_FILE directly). Filtering them out of Compose's
|
||||
# copy is what makes that warning actually go away, permanently, regardless
|
||||
# of what characters end up in either password.
|
||||
COMPOSE_ENV_FILE="$(mktemp)"
|
||||
trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
|
||||
grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"
|
||||
|
||||
# -p pins the Compose project name to the environment (default is the
|
||||
# directory name, which every environment shares — that made staging quietly
|
||||
# reuse dev's db_data volume/credentials the first time this ran).
|
||||
COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${ENV_FILE}"
|
||||
COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${COMPOSE_ENV_FILE}"
|
||||
|
||||
echo "==> writing DB secret files (bypasses compose's \${VAR} interpolation entirely)"
|
||||
SECRETS_DIR="secrets/${ENVIRONMENT}"
|
||||
|
||||
+8
-1
@@ -12,7 +12,14 @@ cd "$REPO_ROOT"
|
||||
ENV_FILE=".env.staging"
|
||||
export ENVIRONMENT=staging
|
||||
|
||||
COMPOSE="docker compose -p bookstore-staging -f docker-compose.yml -f docker-compose.staging.yml --env-file ${ENV_FILE}"
|
||||
# See deploy.sh for why: Compose warns on any $-shaped value in --env-file
|
||||
# even when unused, so DB_PASSWORD/DB_ROOT_PASSWORD are filtered out of the
|
||||
# copy Compose actually sees.
|
||||
COMPOSE_ENV_FILE="$(mktemp)"
|
||||
trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
|
||||
grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"
|
||||
|
||||
COMPOSE="docker compose -p bookstore-staging -f docker-compose.yml -f docker-compose.staging.yml --env-file ${COMPOSE_ENV_FILE}"
|
||||
|
||||
echo "!! this OVERWRITES the staging database and uploads !!"
|
||||
read -r -p "type 'restore' to continue: " confirm
|
||||
|
||||
@@ -16,8 +16,8 @@ services:
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
env_file:
|
||||
- .env.production
|
||||
environment:
|
||||
SITE_DOMAIN: ${SITE_DOMAIN}
|
||||
volumes:
|
||||
- ./docker/caddy/Caddyfile.production:/etc/caddy/Caddyfile:ro
|
||||
- wp_core:/var/www/html:ro
|
||||
|
||||
@@ -16,8 +16,8 @@ services:
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
env_file:
|
||||
- .env.staging
|
||||
environment:
|
||||
SITE_DOMAIN: ${SITE_DOMAIN}
|
||||
volumes:
|
||||
- ./docker/caddy/Caddyfile.staging:/etc/caddy/Caddyfile:ro
|
||||
- wp_core:/var/www/html:ro
|
||||
|
||||
+18
-18
@@ -12,10 +12,20 @@
|
||||
# support a `_FILE` convention specifically for this — point at a file path
|
||||
# (never risky) and the container reads the raw contents itself, bypassing
|
||||
# Compose's interpolation entirely. deploy.sh writes these files fresh from
|
||||
# .env.<environment> before every `up`. The supplier/payment keys below are
|
||||
# still passed the old way and remain exposed to the same class of bug —
|
||||
# nothing consumes them yet (bookstore-core is still a stub), so when that
|
||||
# code is written it should read `_FILE` variants the same way.
|
||||
# .env.<environment> before every `up`.
|
||||
#
|
||||
# These are plain bind mounts, NOT Compose's native `secrets:` block —
|
||||
# Compose's `secrets:` construct reads the referenced file's *content* as
|
||||
# part of its own config model and applies the same interpolation warning
|
||||
# to it (confirmed: it still warned on "$BRjTx3tlmSpz" even after that
|
||||
# value was fully removed from every ${VAR} and --env-file path). A plain
|
||||
# bind mount never touches the file's content, only its path, so it's
|
||||
# immune to this entirely.
|
||||
#
|
||||
# The supplier/payment keys below are still passed the old ${VAR} way and
|
||||
# remain exposed to the same class of bug — nothing consumes them yet
|
||||
# (bookstore-core is still a stub), so when that code is written it should
|
||||
# read `_FILE` variants the same way.
|
||||
x-bookstore-env: &bookstore-env
|
||||
WORDPRESS_DB_HOST: db
|
||||
WORDPRESS_DB_NAME: ${DB_NAME}
|
||||
@@ -38,15 +48,6 @@ x-bookstore-env: &bookstore-env
|
||||
HELCIM_ACCOUNT_ID: ${HELCIM_ACCOUNT_ID:-}
|
||||
MAILERLITE_API_KEY: ${MAILERLITE_API_KEY:-}
|
||||
|
||||
x-bookstore-secrets: &bookstore-db-secret
|
||||
- db_password
|
||||
|
||||
secrets:
|
||||
db_password:
|
||||
file: ./secrets/${ENVIRONMENT}/db_password
|
||||
db_root_password:
|
||||
file: ./secrets/${ENVIRONMENT}/db_root_password
|
||||
|
||||
services:
|
||||
db:
|
||||
image: mariadb:11
|
||||
@@ -56,11 +57,10 @@ services:
|
||||
MARIADB_USER: ${DB_USER}
|
||||
MARIADB_PASSWORD_FILE: /run/secrets/db_password
|
||||
MARIADB_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
|
||||
secrets:
|
||||
- db_password
|
||||
- db_root_password
|
||||
volumes:
|
||||
- db_data:/var/lib/mysql
|
||||
- ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
|
||||
- ./secrets/${ENVIRONMENT}/db_root_password:/run/secrets/db_root_password:ro
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "mariadb-admin ping -h 127.0.0.1 -u$$MARIADB_USER -p\"$$(cat /run/secrets/db_password)\" --silent"]
|
||||
interval: 5s
|
||||
@@ -88,13 +88,13 @@ services:
|
||||
redis:
|
||||
condition: service_healthy
|
||||
environment: *bookstore-env
|
||||
secrets: *bookstore-db-secret
|
||||
volumes:
|
||||
- wp_core:/var/www/html
|
||||
- wp_uploads:/var/www/html/wp-content/uploads
|
||||
- wp_themes:/var/www/html/wp-content/themes
|
||||
- ./wp-content/plugins/bookstore-core:/var/www/html/wp-content/plugins/bookstore-core
|
||||
- ./wp-content/mu-plugins:/var/www/html/wp-content/mu-plugins
|
||||
- ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
|
||||
|
||||
cron:
|
||||
build:
|
||||
@@ -104,7 +104,6 @@ services:
|
||||
- wordpress
|
||||
entrypoint: ["/bin/sh", "/usr/local/bin/cron-entrypoint.sh"]
|
||||
environment: *bookstore-env
|
||||
secrets: *bookstore-db-secret
|
||||
volumes:
|
||||
- wp_core:/var/www/html
|
||||
- wp_uploads:/var/www/html/wp-content/uploads
|
||||
@@ -112,6 +111,7 @@ services:
|
||||
- ./wp-content/plugins/bookstore-core:/var/www/html/wp-content/plugins/bookstore-core
|
||||
- ./wp-content/mu-plugins:/var/www/html/wp-content/mu-plugins
|
||||
- ./docker/cron/entrypoint.sh:/usr/local/bin/cron-entrypoint.sh:ro
|
||||
- ./secrets/${ENVIRONMENT}/db_password:/run/secrets/db_password:ro
|
||||
|
||||
volumes:
|
||||
db_data:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{$SITE_DOMAIN} {
|
||||
http://{$SITE_DOMAIN} {
|
||||
encode gzip
|
||||
|
||||
# Launch gate: "No staging URLs are publicly indexed." Belt-and-suspenders
|
||||
|
||||
Reference in New Issue
Block a user