ee0dbc428f
The previous interpolation used `${PICLOUD_ADMIN_USERNAME:-admin}` and
`${PICLOUD_ADMIN_PASSWORD:-admin}`, which made docker compose silently
bootstrap a production stack with `admin`/`admin` whenever the operator
forgot to set them. Flip to `${VAR:?…}` so an unset value aborts
`docker compose up` with a clear "set this var" message; dev still gets
the convenient default through the gitignored `.env` (documented in
`.env.example`).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 lines
1.6 KiB
Plaintext
40 lines
1.6 KiB
Plaintext
# Copy to `.env` and adjust. `docker compose up` reads this file
|
|
# automatically; the picloud binary on the host ignores it (use the
|
|
# explicit env vars listed in CLAUDE.md).
|
|
|
|
# ---------- Caddy ----------
|
|
# Host port the dev stack listens on. Default 8000 because :80 needs
|
|
# privileges and :8080 is occupied by an unrelated local service on
|
|
# this dev machine.
|
|
PICLOUD_HOST_PORT=8000
|
|
|
|
# Production only — used by docker-compose.prod.yml. Caddy obtains a
|
|
# Let's Encrypt certificate for PICLOUD_DOMAIN using PICLOUD_ADMIN_EMAIL.
|
|
# PICLOUD_DOMAIN=picloud.example.com
|
|
# PICLOUD_ADMIN_EMAIL=admin@example.com
|
|
|
|
# ---------- Postgres ----------
|
|
POSTGRES_DB=picloud
|
|
POSTGRES_USER=picloud
|
|
POSTGRES_PASSWORD=picloud
|
|
|
|
# Host port the dev Postgres listens on (loopback only). Default 15432
|
|
# because the conventional 5432 is frequently already bound locally.
|
|
PICLOUD_POSTGRES_HOST_PORT=15432
|
|
|
|
# ---------- Orchestrator ----------
|
|
# tracing-subscriber filter; comma-separated module=level pairs.
|
|
RUST_LOG=info,picloud=debug
|
|
|
|
# Public base URL the dashboard uses to render full URLs for user routes.
|
|
# Set to the host:port (and scheme) users actually reach in their browser.
|
|
PICLOUD_PUBLIC_BASE_URL=http://localhost:8000
|
|
|
|
# ---------- Bootstrap admin ----------
|
|
# Required. Used once on first startup to seed the admin_users table.
|
|
# Ignored on subsequent boots if the table is non-empty. For prod,
|
|
# prefer PICLOUD_ADMIN_PASSWORD_HASH (pre-computed Argon2id PHC) so the
|
|
# raw password never lands in env or compose files; see blueprint §11.5.
|
|
PICLOUD_ADMIN_USERNAME=admin
|
|
PICLOUD_ADMIN_PASSWORD=admin
|