From 686aca7060a18e8cd539d848735824637ce6b692 Mon Sep 17 00:00:00 2001 From: oskar Date: Thu, 25 Jun 2026 13:41:55 +0200 Subject: [PATCH] fix(deploy-node): pass --env-file per-service so env-interpolated binds resolve (fleet-prometheus 0.0.0.0 leak) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without --env-file, docker compose resolved variables from the repo root (cwd), not from services//.env where the file actually lives. This caused ${TAILSCALE_BIND_IP} to expand to empty string, binding fleet-prometheus on 0.0.0.0:9090 instead of the Tailscale-only IP — a security hole on the public VPS. Guard mirrors the existing override-file pattern: only add --env-file when the file exists, so services without .env continue to work as before. Flag is injected into COMPOSE_CMD (before the `up` subcommand) so docker compose sees it as a global option. Co-Authored-By: Claude Sonnet 4.6 --- scripts/deploy/deploy-node.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/deploy/deploy-node.sh b/scripts/deploy/deploy-node.sh index f2c5c21..1b6849c 100755 --- a/scripts/deploy/deploy-node.sh +++ b/scripts/deploy/deploy-node.sh @@ -102,6 +102,11 @@ for service in "${SERVICES[@]}"; do COMPOSE_CMD="${COMPOSE_CMD} -f ${OVERRIDE_FILE}" fi + ENV_FILE="${REPO_PATH}/services/${service}/.env" + if [ -f "$ENV_FILE" ]; then + COMPOSE_CMD="${COMPOSE_CMD} --env-file ${ENV_FILE}" + fi + $COMPOSE_CMD up -d --remove-orphans done