From ee0dbc428ff510d2822c52df71ed3fc118765c5f Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Tue, 26 May 2026 21:00:52 +0200 Subject: [PATCH] chore(compose): require bootstrap admin env vars instead of defaulting to admin/admin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous interpolation used `${PICLOUD_ADMIN_USERNAME:-admin}` and `${PICLOUD_ADMIN_PASSWORD:-admin}`, which made docker compose silently bootstrap a production stack with `admin`/`admin` whenever the operator forgot to set them. Flip to `${VAR:?…}` so an unset value aborts `docker compose up` with a clear "set this var" message; dev still gets the convenient default through the gitignored `.env` (documented in `.env.example`). Co-Authored-By: Claude Opus 4.7 (1M context) --- .env.example | 8 ++++++++ docker-compose.yml | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/.env.example b/.env.example index d458691..47557a0 100644 --- a/.env.example +++ b/.env.example @@ -29,3 +29,11 @@ RUST_LOG=info,picloud=debug # Public base URL the dashboard uses to render full URLs for user routes. # Set to the host:port (and scheme) users actually reach in their browser. PICLOUD_PUBLIC_BASE_URL=http://localhost:8000 + +# ---------- Bootstrap admin ---------- +# Required. Used once on first startup to seed the admin_users table. +# Ignored on subsequent boots if the table is non-empty. For prod, +# prefer PICLOUD_ADMIN_PASSWORD_HASH (pre-computed Argon2id PHC) so the +# raw password never lands in env or compose files; see blueprint §11.5. +PICLOUD_ADMIN_USERNAME=admin +PICLOUD_ADMIN_PASSWORD=admin diff --git a/docker-compose.yml b/docker-compose.yml index bbd8403..8c9a88d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -40,6 +40,12 @@ services: DATABASE_URL: postgres://${POSTGRES_USER:-picloud}:${POSTGRES_PASSWORD:-picloud}@postgres:5432/${POSTGRES_DB:-picloud} RUST_LOG: ${RUST_LOG:-info} PICLOUD_PUBLIC_BASE_URL: ${PICLOUD_PUBLIC_BASE_URL:-http://localhost:8000} + # Bootstrap admin (Phase 3a). Read once on first start to seed the + # admin_users table; ignored on subsequent boots if the table is + # non-empty. No defaults on purpose — leaving these unset in prod + # is a foot-gun. For dev, .env.example documents sensible values. + PICLOUD_ADMIN_USERNAME: ${PICLOUD_ADMIN_USERNAME:?set PICLOUD_ADMIN_USERNAME (see .env.example)} + PICLOUD_ADMIN_PASSWORD: ${PICLOUD_ADMIN_PASSWORD:?set PICLOUD_ADMIN_PASSWORD (see .env.example)} depends_on: postgres: condition: service_healthy