twooeyandClaude Sonnet 5
f65581bc50
Two separate leaks were causing the same cosmetic-but-annoying warning to
survive every previous fix attempt:
1. Compose's own `secrets:` block reads the referenced file's *content*
as part of its config model, and applies the same interpolation
warning to it — even with DB_PASSWORD fully removed from every ${VAR}
and --env-file path. Switched from Compose's native `secrets:` to plain
bind mounts at the same /run/secrets/* paths: a bind mount only ever
touches the file's path, never its content, so it's immune. (Verified
this precisely with an isolated repro before rolling it out — the two
mechanisms behave differently even though they look equivalent.)
2. caddy's `env_file: .env.staging` (a leftover from the since-removed
basic-auth setup) loaded the *raw*, unfiltered env file directly,
bypassing deploy.sh/backup.sh/restore.sh's filtered-copy mechanism
entirely. Caddy only ever needed SITE_DOMAIN; switched to passing that
one value directly instead of the whole file.
Also fixed Caddyfile.staging: the site address had no explicit scheme, so
Caddy's automatic-HTTPS logic still applied to a private IP (registering
its own internal CA and redirecting HTTP->HTTPS) — not the "plain HTTP
only" behavior I'd assumed and told the user earlier. Prefixed with
`http://` to genuinely disable automatic HTTPS for this LAN-only box.
Verified end-to-end: fresh deploy with dollar-sign DB passwords produces
zero warnings, serves HTTP 200 on plain http:// with no redirect, and the
DB connection genuinely authenticates.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
37 lines
963 B
Makefile
37 lines
963 B
Makefile
ENV ?= dev
|
|
export ENVIRONMENT = $(ENV)
|
|
# DB_PASSWORD/DB_ROOT_PASSWORD are stripped from what Compose loads — they
|
|
# only flow through secrets/ now, and Compose warns "variable not set" on
|
|
# any $-shaped value in --env-file even when nothing consumes it. Rewritten
|
|
# fresh on every `make` invocation, so it can't drift from .env.$(ENV).
|
|
COMPOSE_ENV_FILE := .env.$(ENV).compose
|
|
$(shell grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' .env.$(ENV) > $(COMPOSE_ENV_FILE) 2>/dev/null)
|
|
COMPOSE = docker compose -p bookstore-$(ENV) -f docker-compose.yml -f docker-compose.$(ENV).yml --env-file $(COMPOSE_ENV_FILE)
|
|
|
|
.PHONY: up down ps logs shell wp deploy backup
|
|
|
|
up:
|
|
$(COMPOSE) up -d --build
|
|
|
|
down:
|
|
$(COMPOSE) down
|
|
|
|
ps:
|
|
$(COMPOSE) ps
|
|
|
|
logs:
|
|
$(COMPOSE) logs -f
|
|
|
|
shell:
|
|
$(COMPOSE) exec wordpress bash
|
|
|
|
# make wp ENV=staging ARGS="plugin list"
|
|
wp:
|
|
$(COMPOSE) exec wordpress wp $(ARGS) --allow-root
|
|
|
|
deploy:
|
|
./deploy/deploy.sh $(ENV)
|
|
|
|
backup:
|
|
./deploy/backup.sh $(ENV)
|