Repository navigation
fix(docker): name the required secrets in profile env templates - #136
Merged
Merged
Conversation
Compose already refuses to start without the three secrets. Nothing checked that the profile templates name them, so a copy of postgres.env or oracle.env omitted two required keys. The check matches a commented key and rejects an assignment. CI runs it on pull requests.
Copying a profile to .env left SITMUN_USER_SECRET and SITMUN_MBTILES_JOB_HANDLE_SECRET unnamed, so Compose stopped with "variable is required". The templates now name the three keys and still leave them unset. Fixes #134
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Copying a profile to
.envnamed onlyMIDDLEWARE_SECRET, so an operator had no hint ofSITMUN_USER_SECRETorSITMUN_MBTILES_JOB_HANDLE_SECRET. Root Compose still refuses to start until those values are set. The templates now show all three names and how to generate them.Fixes #134
What changed
profiles/*.envfile lists the three secrets as comments and leaves them unset.postgres.envandoracle.envno longer mention onlyMIDDLEWARE_SECRET.tools/scripts/check-compose-secrets.shfails when a template omits a commented key or assigns a value. It still checks that Compose refuses to render without the secrets..github/workflows/compose-secrets.ymlruns that script on pull requests.Scope
Profile templates, the secret check, and its workflow.
setup.sh,setup.ps1, and the README are unchanged. No secret values are committed. A copied profile still does not start until the operator generates the values.Verification
bash tools/scripts/check-compose-secrets.shexited 1 and reported that each profile does not nameSITMUN_USER_SECRETorSITMUN_MBTILES_JOB_HANDLE_SECRET.