6e0a760271
Running in a container picked up host-oriented values from .env via env_file: - MEDIA_PATH pointed at a host path that doesn't exist in the container, so every upload 500'd with EACCES; point it at the /media volume mount. - ADMIN_PASSWORD_HASH lost its $-delimited bcrypt segments to Compose interpolation (admin login 401'd); re-supply it with $$ escaping. - COMMENTS_ENABLED=false to smoke-test the comment kill-switch. NOTE: production compose + .env carry the same MEDIA_PATH / admin-hash pitfalls. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
2.5 KiB
YAML
42 lines
2.5 KiB
YAML
# Dev-only overlay. NOT loaded automatically (unlike docker-compose.override.yml).
|
|
# Opt in explicitly for local development when you need host access to Postgres:
|
|
# docker compose -f docker-compose.yml -f docker-compose.dev.yml up
|
|
# Never use this overlay in production — it publishes the database port on the host.
|
|
services:
|
|
db:
|
|
ports:
|
|
- "5432:5432"
|
|
app:
|
|
# Relax the production secret guard for local dev — the dev sentinel JWT_SECRET
|
|
# is tolerated (warned) rather than rejected.
|
|
environment:
|
|
APP_ENV: development
|
|
# `.env` sets DATABASE_URL to @localhost for the run-backend-natively workflow
|
|
# (the db port is published above for that). When the app runs IN a container,
|
|
# localhost is the app itself — point it at the `db` service instead. Creds are
|
|
# interpolated from .env so nothing is hardcoded.
|
|
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
|
|
# `.env` sets MEDIA_PATH to a HOST path (/home/fabi/EventSnap/media) for the
|
|
# run-backend-natively workflow. In a container that path doesn't exist and the
|
|
# app user can't create it from `/`, so every upload 500s with EACCES. The media
|
|
# volume is mounted at /media (see docker-compose.yml) — point the app there.
|
|
MEDIA_PATH: /media
|
|
# Recent Docker Compose interpolates env_file values, so the `$` segments of the
|
|
# bcrypt ADMIN_PASSWORD_HASH in .env get eaten (the salt reads as an unset var) —
|
|
# every admin login then 401s. Re-supply it here with `$` doubled to `$$` so Compose
|
|
# passes the literal hash. NOTE: production (docker-compose.yml + .env) has the SAME
|
|
# bug — escape the hash as `$$` in .env, or set it via `environment:` there too.
|
|
ADMIN_PASSWORD_HASH: "$$2b$$12$$PAteqCNpsbm6d0HTJcywfOaUovjAU.iNVlsL7EDYaRC/z4P/xv7ye"
|
|
# Smoke-testing the comment kill-switch: boot-time flag, so it needs a restart
|
|
# (not an admin-UI toggle). Backend rejects new comments (403) and the frontend
|
|
# hides the whole comment UI. Flip back to true (or drop this line) to restore.
|
|
COMMENTS_ENABLED: "false"
|
|
|
|
caddy:
|
|
# The prod caddy service has no env_file, so the Caddyfile's `{$DOMAIN}` expands
|
|
# to empty and the site block collapses into a malformed global block. Supply it
|
|
# for local dev (from .env → localhost, which Caddy serves with a local self-signed
|
|
# cert). NOTE: the prod compose likely needs DOMAIN wired to caddy too.
|
|
environment:
|
|
DOMAIN: ${DOMAIN}
|