fix(deploy): align .env.docker.example and prestart.sh with docker-compose.yaml

.env.docker.example

@@ -6,13 +6,15 @@
 #   cp .env.docker.example .env.docker
 #   $EDITOR .env.docker
 #   docker compose --env-file .env.docker up --build
+#
+# Variable names MUST match docker-compose.yaml ${VARIABLE} references.
 # =============================================================================
 
 # --- PostgreSQL (local container) ---------------------------------------------
 POSTGRES_USER=crm_user
 # Generate a strong password, e.g.:
 #   python -c "import secrets; print(secrets.token_urlsafe(24))"
-POSTGRES_PASSWORD=STRONG_PASSWORD_HERE
+DB_PASSWORD=STRONG_PASSWORD_HERE
 POSTGRES_DB=crm_db
 
 # --- Redis (REQUIRED) ---------------------------------------------------------
@@ -20,43 +22,36 @@ POSTGRES_DB=crm_db
 #   python -c "import secrets; print(secrets.token_urlsafe(24))"
 REDIS_PASSWORD=STRONG_REDIS_PASSWORD_HERE
 
-# --- CRM Application: Runtime DB user (NOSUPERUSER, NOBYPASSRLS) --------------
-# The app and worker use crm_runtime — RLS is enforced.
-# This user is created by migration 0044 with DML-only permissions.
-# Set RUNTIME_DB_PASSWORD to the password you want for crm_runtime.
-RUNTIME_DB_PASSWORD=STRONG_RUNTIME_PASSWORD_HERE
-DATABASE_URL=postgresql+asyncpg://crm_runtime:STRONG_RUNTIME_PASSWORD_HERE@postgres:5432/crm_db
-
-# --- CRM Application: Migration DB user (NOSUPERUSER, BYPASSRLS) ------------
-# Migrations use crm_migration (NOSUPERUSER, BYPASSRLS) — NOT crm_user (SUPERUSER).
-# This is NOT used by the app at runtime — only by prestart.sh / alembic.
-MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_migration:STRONG_PASSWORD_HERE@postgres:5432/crm_db
-
 # --- SECRET_KEY (REQUIRED, min 32 chars) -------------------------------------
 # Session signing secret. MUST be at least 32 characters.
 # Generate with:
 #   python -c "import secrets; print(secrets.token_urlsafe(48))"
 SECRET_KEY=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx
 
-# --- Frontend URL (for email links) ------------------------------------------
+# --- Domain / Frontend URL ----------------------------------------------------
 # The public URL where users access the LeoCRM frontend.
-# Used for password reset links, invitations, etc.
+# Used for password reset links, invitations, CORS, etc.
+APP_DOMAIN=https://crm.example.com
 FRONTEND_URL=https://crm.example.com
-
-# --- CORS / environment -------------------------------------------------------
-# Comma-separated, NO wildcards. In dev we allow localhost:8000 (the app) and
-# :5173 (e.g. Vite dev server). In production, restrict to the real domain.
 CORS_ORIGINS=https://crm.example.com
+
+# --- Environment --------------------------------------------------------------
 ENVIRONMENT=production
 LOG_LEVEL=INFO
+SESSION_COOKIE_SECURE=true
+STORAGE_PATH=/data/storage
 
 # --- SMTP (for password reset emails) -----------------------------------------
 SMTP_HOST=smtp.example.com
 SMTP_PORT=587
-SMTP_USERNAME=noreply@example.com
+SMTP_USER=noreply@example.com
 SMTP_PASSWORD=YOUR_SMTP_PASSWORD
-SMTP_FROM_EMAIL=noreply@example.com
-SMTP_USE_TLS=true
+SMTP_FROM=noreply@example.com
+SMTP_TLS=true
 
 # --- bcrypt tuning ----------------------------------------------------------
 BCRYPT_ROUNDS=12
+
+# --- Admin user (seeded on first start) --------------------------------------
+ADMIN_EMAIL=admin@example.com
+ADMIN_PASSWORD=Admin123!

prestart.sh

@@ -3,15 +3,15 @@
 # prestart.sh — Container entrypoint for CRM API container
 #
 # Responsibilities:
-#   1. Run Alembic DB migrations (alembic upgrade head) using the owner user.
-#   2. Set the crm_runtime password (for RLS-enforced app access).
+#   1. Run Alembic DB migrations (alembic upgrade head) using the migration user.
+#   2. Set passwords for all application DB roles (crm_api, crm_auth, crm_worker, crm_migration).
 #   3. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly).
 #
 # Notes:
 #   - `set -e` ensures the container crashes loudly if migrations fail.
 #   - The ARQ worker runs in a separate container (see worker.sh / docker-compose).
-#   - Migrations use MIGRATION_DATABASE_URL (crm_migration, NOSUPERUSER, BYPASSRLS).
-#   - The app uses DATABASE_URL (crm_runtime, NOSUPERUSER, NOBYPASSRLS).
+#   - Migrations use MIGRATION_DATABASE_URL (crm_user for bootstrap, then crm_migration).
+#   - The app uses DATABASE_URL (crm_api, NOSUPERUSER, NOBYPASSRLS).
 # =============================================================================
 
 set -e