oskar/homelab-codex-ws
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix(deploy-node): pass --env-file per-service so env-interpolated binds resolve (fleet-prometheus 0.0.0.0 leak)

Browse source 
Without --env-file, docker compose resolved variables from the repo root
(cwd), not from services/<service>/.env where the file actually lives.
This caused ${TAILSCALE_BIND_IP} to expand to empty string, binding
fleet-prometheus on 0.0.0.0:9090 instead of the Tailscale-only IP —
a security hole on the public VPS.

Guard mirrors the existing override-file pattern: only add --env-file
when the file exists, so services without .env continue to work as
before. Flag is injected into COMPOSE_CMD (before the `up` subcommand)
so docker compose sees it as a global option.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
oskar 2026-06-25 13:41:55 +02:00
parent afc0a52e3e
commit 686aca7060
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
scripts/deploy/deploy-node.sh
View file

@ -102,6 +102,11 @@ for service in "${SERVICES[@]}"; do
COMPOSE_CMD="${COMPOSE_CMD} -f ${OVERRIDE_FILE}" COMPOSE_CMD="${COMPOSE_CMD} -f ${OVERRIDE_FILE}"
fi fi
ENV_FILE="${REPO_PATH}/services/${service}/.env"
if [ -f "$ENV_FILE" ]; then
COMPOSE_CMD="${COMPOSE_CMD} --env-file ${ENV_FILE}"
fi
$COMPOSE_CMD up -d --remove-orphans $COMPOSE_CMD up -d --remove-orphans
done done