trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #433 from trails-cool/fix/infra-compose-secret-defaults

Browse source 
fix(infra): refuse compose up when production secrets are missing
This commit is contained in:
Ullrich Schäfer 2026-05-25 23:03:06 +02:00 • committed by GitHub
commit f239b4adee
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
infrastructure/.env.example
View file

@ -2,8 +2,12 @@
# Copy to .env and fill in values # Copy to .env and fill in values
DOMAIN=trails.cool DOMAIN=trails.cool
# These three are REQUIRED for compose up — the production
# docker-compose.yml refuses to start without them. Generate strong
# random values; never reuse anything from this example file.
POSTGRES_PASSWORD=change-me POSTGRES_PASSWORD=change-me
JWT_SECRET=change-me JWT_SECRET=change-me
SESSION_SECRET=change-me
S3_ACCESS_KEY= S3_ACCESS_KEY=
S3_SECRET_KEY= S3_SECRET_KEY=

4
infrastructure/docker-compose.staging.yml
View file

@ -48,7 +48,7 @@ services:
# to its own planner subdomain. # to its own planner subdomain.
PLANNER_URL: ${PLANNER_URL:-https://planner.${DOMAIN}} PLANNER_URL: ${PLANNER_URL:-https://planner.${DOMAIN}}
IS_FLAGSHIP: "" IS_FLAGSHIP: ""
DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:-trails}@postgres:5432/${STAGING_DATABASE:?STAGING_DATABASE must be set} DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in SOPS secrets.app.env}@postgres:5432/${STAGING_DATABASE:?STAGING_DATABASE must be set}
JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set} JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set}
SESSION_SECRET: ${SESSION_SECRET:?SESSION_SECRET must be set} SESSION_SECRET: ${SESSION_SECRET:?SESSION_SECRET must be set}
NODE_ENV: production NODE_ENV: production
@ -86,7 +86,7 @@ services:
BROUTER_URL: ${BROUTER_URL:?BROUTER_URL must be set} BROUTER_URL: ${BROUTER_URL:?BROUTER_URL must be set}
BROUTER_AUTH_TOKEN: ${BROUTER_AUTH_TOKEN:?BROUTER_AUTH_TOKEN must be set} BROUTER_AUTH_TOKEN: ${BROUTER_AUTH_TOKEN:?BROUTER_AUTH_TOKEN must be set}
OVERPASS_URLS: ${OVERPASS_URLS:-https://lz4.overpass-api.de/api/interpreter,https://overpass-api.de/api/interpreter} OVERPASS_URLS: ${OVERPASS_URLS:-https://lz4.overpass-api.de/api/interpreter,https://overpass-api.de/api/interpreter}
DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:-trails}@postgres:5432/${STAGING_DATABASE} DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in SOPS secrets.app.env}@postgres:5432/${STAGING_DATABASE}
NODE_ENV: production NODE_ENV: production
PORT: 3001 PORT: 3001
SENTRY_RELEASE: ${SENTRY_RELEASE:-} SENTRY_RELEASE: ${SENTRY_RELEASE:-}

12
infrastructure/docker-compose.yml
View file

@ -37,9 +37,9 @@ services:
# "Powered by trails.cool" footer link when not. Default empty = # "Powered by trails.cool" footer link when not. Default empty =
# self-host, which is the safer default. # self-host, which is the safer default.
IS_FLAGSHIP: ${IS_FLAGSHIP:-} IS_FLAGSHIP: ${IS_FLAGSHIP:-}
DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:-trails}@postgres:5432/trails DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in SOPS secrets.app.env}@postgres:5432/trails
JWT_SECRET: ${JWT_SECRET:-change-me-in-production} JWT_SECRET: ${JWT_SECRET:?JWT_SECRET must be set in SOPS secrets.app.env}
SESSION_SECRET: ${SESSION_SECRET:-change-me-in-production} SESSION_SECRET: ${SESSION_SECRET:?SESSION_SECRET must be set in SOPS secrets.app.env}
NODE_ENV: production NODE_ENV: production
PORT: 3000 PORT: 3000
SENTRY_RELEASE: ${SENTRY_RELEASE:-} SENTRY_RELEASE: ${SENTRY_RELEASE:-}
@ -84,7 +84,7 @@ services:
# community instance misbehaves. Override per-env with # community instance misbehaves. Override per-env with
# OVERPASS_URLS in the SOPS file. # OVERPASS_URLS in the SOPS file.
OVERPASS_URLS: ${OVERPASS_URLS:-https://lz4.overpass-api.de/api/interpreter,https://overpass-api.de/api/interpreter} OVERPASS_URLS: ${OVERPASS_URLS:-https://lz4.overpass-api.de/api/interpreter,https://overpass-api.de/api/interpreter}
DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:-trails}@postgres:5432/trails DATABASE_URL: postgres://trails:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in SOPS secrets.app.env}@postgres:5432/trails
NODE_ENV: production NODE_ENV: production
PORT: 3001 PORT: 3001
SENTRY_RELEASE: ${SENTRY_RELEASE:-} SENTRY_RELEASE: ${SENTRY_RELEASE:-}
@ -108,7 +108,7 @@ services:
- trails-shared - trails-shared
environment: environment:
POSTGRES_USER: trails POSTGRES_USER: trails
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-trails} POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in SOPS secrets.app.env}
POSTGRES_DB: trails POSTGRES_DB: trails
volumes: volumes:
- pgdata:/var/lib/postgresql/data - pgdata:/var/lib/postgresql/data
@ -129,7 +129,7 @@ services:
image: prometheuscommunity/postgres-exporter:latest image: prometheuscommunity/postgres-exporter:latest
restart: unless-stopped restart: unless-stopped
environment: environment:
DATA_SOURCE_NAME: postgresql://trails:${POSTGRES_PASSWORD:-trails}@postgres:5432/trails?sslmode=disable DATA_SOURCE_NAME: postgresql://trails:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in SOPS secrets.app.env}@postgres:5432/trails?sslmode=disable
PG_EXPORTER_EXTEND_QUERY_PATH: /etc/postgres-exporter/queries.yml PG_EXPORTER_EXTEND_QUERY_PATH: /etc/postgres-exporter/queries.yml
volumes: volumes:
- ./postgres/queries.yml:/etc/postgres-exporter/queries.yml:ro - ./postgres/queries.yml:/etc/postgres-exporter/queries.yml:ro