fabi/Mangalord
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(compose): wire all documented backend env vars + regression test (0.87.12)

Browse Source 
0.87.1 added 12+ env vars to `.env.example` but the compose backend
`environment:` block forwarded none of them — `.env` interpolation
doesn't pass vars to the container. Operators got
anonymous-serving sites, silent ADMIN_* no-ops, and missing
ANALYSIS_* configuration.

Wire 36 backend-consumed vars; also substitute the hardcoded
`BACKEND_URL` on the frontend; emit a startup warning on half-set
`ADMIN_USERNAME`/`ADMIN_PASSWORD`. Regression-test parses
docker-compose.yml and asserts the wiring.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-23 07:25:57 +02:00
parent 34d6d570eb
commit 95b98eebf1
5 changed files with 155 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
docker-compose.yml
View File

@@ -75,12 +75,39 @@ services:
COOKIE_SECURE: ${COOKIE_SECURE:-true}
COOKIE_DOMAIN: ${COOKIE_DOMAIN:-}
SESSION_TTL_DAYS: ${SESSION_TTL_DAYS:-30}
AUTH_RATE_PER_SEC: ${AUTH_RATE_PER_SEC:-5}
AUTH_RATE_BURST: ${AUTH_RATE_BURST:-10}
# CORS — same-origin by default; populate when serving the API on
# a different host than the frontend.
CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}
# Admin CSRF allowlist. Empty in default deploy → cookie-auth admin
# mutations are refused (fail-closed since 0.87.2). Set to the
# SvelteKit origin (e.g. https://app.example.com) for browser deploys.
ADMIN_ALLOWED_ORIGINS: ${ADMIN_ALLOWED_ORIGINS:-}
# Admin bootstrap. Half-set is treated as "skip bootstrap"; either
# both or neither. Set on first boot, then unset for subsequent
# deploys so the password isn't re-applied accidentally (existing
# users' passwords are never overwritten by this).
ADMIN_USERNAME: ${ADMIN_USERNAME:-}
ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
# Site-wide auth gates (env-only; never persisted to app_settings).
PRIVATE_MODE: ${PRIVATE_MODE:-false}
ALLOW_SELF_REGISTER: ${ALLOW_SELF_REGISTER:-true}
# Upload limits.
MAX_REQUEST_BYTES: ${MAX_REQUEST_BYTES:-209715200}
MAX_FILE_BYTES: ${MAX_FILE_BYTES:-20971520}
# Crawler boot seeds (first-boot only; switch to dashboard-editable
# once the app_settings row exists).
CRAWLER_START_URL: ${CRAWLER_START_URL:-}
CRAWLER_CDN_HOST: ${CRAWLER_CDN_HOST:-}
CRAWLER_LIMIT: ${CRAWLER_LIMIT:-0}
CRAWLER_JOB_TIMEOUT_SECS: ${CRAWLER_JOB_TIMEOUT_SECS:-600}
CRAWLER_METADATA_MAX_CONSECUTIVE_FAILURES: ${CRAWLER_METADATA_MAX_CONSECUTIVE_FAILURES:-10}
CRAWLER_BROWSER_RESTART_THRESHOLD: ${CRAWLER_BROWSER_RESTART_THRESHOLD:-3}
# Crawler download safety — env-only, never persisted.
CRAWLER_DOWNLOAD_ALLOWLIST: ${CRAWLER_DOWNLOAD_ALLOWLIST:-}
CRAWLER_ALLOW_ANY_HOST: ${CRAWLER_ALLOW_ANY_HOST:-false}
CRAWLER_MAX_IMAGE_BYTES: ${CRAWLER_MAX_IMAGE_BYTES:-33554432}
# System-chromium override for the crawler. Leave blank to use the
# bundled fetcher; set to e.g. /usr/bin/chromium-headless-shell on
# arm64 deployments. Pair with `--build-arg INSTALL_CHROMIUM=true`
@@ -96,6 +123,15 @@ services:
CRAWLER_TOR_CONTROL_URL: ${CRAWLER_TOR_CONTROL_URL-tcp://tor:9051}
CRAWLER_TOR_CONTROL_PASSWORD: ${TOR_CONTROL_PASSWORD:?TOR_CONTROL_PASSWORD must be set in .env}
CRAWLER_TOR_RECIRCUIT_MAX_ATTEMPTS: ${CRAWLER_TOR_RECIRCUIT_MAX_ATTEMPTS:-3}
# Analysis worker (vision) — boot seeds + env-only API key.
ANALYSIS_ENABLED: ${ANALYSIS_ENABLED:-false}
ANALYSIS_VISION_URL: ${ANALYSIS_VISION_URL:-}
ANALYSIS_VISION_MODEL: ${ANALYSIS_VISION_MODEL:-}
ANALYSIS_WORKERS: ${ANALYSIS_WORKERS:-1}
ANALYSIS_JOB_TIMEOUT_SECS: ${ANALYSIS_JOB_TIMEOUT_SECS:-600}
# API key never gets persisted to app_settings; bearer-attached to
# every vision call.
ANALYSIS_API_KEY: ${ANALYSIS_API_KEY:-}
# Vision readiness gate (env-ONLY, not a dashboard setting). When set,
# the analysis worker refuses to lease a page until this answers 2xx, so
# the vision-manager autoscaler can idle-stop the vision container
@@ -120,7 +156,10 @@ services:
environment:
# SvelteKit's hooks.server.ts proxies /api/* to this URL so the
# browser only ever talks to :3000 and cookies stay same-origin.
BACKEND_URL: http://backend:8080
# `.env` override exists for deploys where the SvelteKit container
# needs to reach a backend on a different hostname (typical with
# an external reverse proxy in front of axum).
BACKEND_URL: ${BACKEND_URL:-http://backend:8080}
# Per-request wall-clock cap for the /api/* reverse proxy. Defaults
# to 300000 (5 min) in hooks.server.ts; raise/lower via .env.
BACKEND_PROXY_TIMEOUT_MS: ${BACKEND_PROXY_TIMEOUT_MS:-300000}