From 5ac6fb36de7180239c689a5aa251cb18c1241d14 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Thu, 6 Aug 2026 23:53:18 +0200 Subject: [PATCH] fix(deploy): align .env.docker.example and prestart.sh with docker-compose.yaml --- .env.docker.example | 39 +++++++++++++++++---------------------- prestart.sh | 8 ++++---- 2 files changed, 21 insertions(+), 26 deletions(-) diff --git a/.env.docker.example b/.env.docker.example index 861d78a..e9ef34c 100644 --- a/.env.docker.example +++ b/.env.docker.example @@ -6,13 +6,15 @@ # cp .env.docker.example .env.docker # $EDITOR .env.docker # docker compose --env-file .env.docker up --build +# +# Variable names MUST match docker-compose.yaml ${VARIABLE} references. # ============================================================================= # --- PostgreSQL (local container) --------------------------------------------- POSTGRES_USER=crm_user # Generate a strong password, e.g.: # python -c "import secrets; print(secrets.token_urlsafe(24))" -POSTGRES_PASSWORD=STRONG_PASSWORD_HERE +DB_PASSWORD=STRONG_PASSWORD_HERE POSTGRES_DB=crm_db # --- Redis (REQUIRED) --------------------------------------------------------- @@ -20,43 +22,36 @@ POSTGRES_DB=crm_db # python -c "import secrets; print(secrets.token_urlsafe(24))" REDIS_PASSWORD=STRONG_REDIS_PASSWORD_HERE -# --- CRM Application: Runtime DB user (NOSUPERUSER, NOBYPASSRLS) -------------- -# The app and worker use crm_runtime — RLS is enforced. -# This user is created by migration 0044 with DML-only permissions. -# Set RUNTIME_DB_PASSWORD to the password you want for crm_runtime. -RUNTIME_DB_PASSWORD=STRONG_RUNTIME_PASSWORD_HERE -DATABASE_URL=postgresql+asyncpg://crm_runtime:STRONG_RUNTIME_PASSWORD_HERE@postgres:5432/crm_db - -# --- CRM Application: Migration DB user (NOSUPERUSER, BYPASSRLS) ------------ -# Migrations use crm_migration (NOSUPERUSER, BYPASSRLS) — NOT crm_user (SUPERUSER). -# This is NOT used by the app at runtime — only by prestart.sh / alembic. -MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_migration:STRONG_PASSWORD_HERE@postgres:5432/crm_db - # --- SECRET_KEY (REQUIRED, min 32 chars) ------------------------------------- # Session signing secret. MUST be at least 32 characters. # Generate with: # python -c "import secrets; print(secrets.token_urlsafe(48))" SECRET_KEY=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx -# --- Frontend URL (for email links) ------------------------------------------ +# --- Domain / Frontend URL ---------------------------------------------------- # The public URL where users access the LeoCRM frontend. -# Used for password reset links, invitations, etc. +# Used for password reset links, invitations, CORS, etc. +APP_DOMAIN=https://crm.example.com FRONTEND_URL=https://crm.example.com - -# --- CORS / environment ------------------------------------------------------- -# Comma-separated, NO wildcards. In dev we allow localhost:8000 (the app) and -# :5173 (e.g. Vite dev server). In production, restrict to the real domain. CORS_ORIGINS=https://crm.example.com + +# --- Environment -------------------------------------------------------------- ENVIRONMENT=production LOG_LEVEL=INFO +SESSION_COOKIE_SECURE=true +STORAGE_PATH=/data/storage # --- SMTP (for password reset emails) ----------------------------------------- SMTP_HOST=smtp.example.com SMTP_PORT=587 -SMTP_USERNAME=noreply@example.com +SMTP_USER=noreply@example.com SMTP_PASSWORD=YOUR_SMTP_PASSWORD -SMTP_FROM_EMAIL=noreply@example.com -SMTP_USE_TLS=true +SMTP_FROM=noreply@example.com +SMTP_TLS=true # --- bcrypt tuning ---------------------------------------------------------- BCRYPT_ROUNDS=12 + +# --- Admin user (seeded on first start) -------------------------------------- +ADMIN_EMAIL=admin@example.com +ADMIN_PASSWORD=Admin123! diff --git a/prestart.sh b/prestart.sh index b1cf61e..9730291 100644 --- a/prestart.sh +++ b/prestart.sh @@ -3,15 +3,15 @@ # prestart.sh — Container entrypoint for CRM API container # # Responsibilities: -# 1. Run Alembic DB migrations (alembic upgrade head) using the owner user. -# 2. Set the crm_runtime password (for RLS-enforced app access). +# 1. Run Alembic DB migrations (alembic upgrade head) using the migration user. +# 2. Set passwords for all application DB roles (crm_api, crm_auth, crm_worker, crm_migration). # 3. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly). # # Notes: # - `set -e` ensures the container crashes loudly if migrations fail. # - The ARQ worker runs in a separate container (see worker.sh / docker-compose). -# - Migrations use MIGRATION_DATABASE_URL (crm_migration, NOSUPERUSER, BYPASSRLS). -# - The app uses DATABASE_URL (crm_runtime, NOSUPERUSER, NOBYPASSRLS). +# - Migrations use MIGRATION_DATABASE_URL (crm_user for bootstrap, then crm_migration). +# - The app uses DATABASE_URL (crm_api, NOSUPERUSER, NOBYPASSRLS). # ============================================================================= set -e