Oskar Kapala
e5c6bfe830
Addresses review findings — all reverting to the live config that worked:
- config.yml mounts at /app/vikunja/config.yml (live path), not /etc/vikunja.
- Remove the vikunja container healthcheck: the image ships no wget/curl, so
an in-container HTTP check is always unhealthy. Health stays on db
(pg_isready) + host-side healthcheck.sh (curl). Live had no app healthcheck.
- Secrets injected exclusively via env_file (.env) on BOTH services; dropped
the ${VAR:?} parse-time interpolation that depended on a .env in cwd. db now
also has env_file. Non-secret env stays inline.
- Rename .env.example -> env.example to match repo convention (forgejo).
Verified: `docker compose -f services/vikunja/docker-compose.yml config` passes;
services/vikunja/.env is gitignored.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
18 lines
762 B
Plaintext
18 lines
762 B
Plaintext
# Vikunja secrets — copy to .env and fill with the REAL live values.
|
|
# .env is gitignored; never commit it.
|
|
#
|
|
# These three values MUST match the running instance or you lose access /
|
|
# break login at cutover. Do not regenerate them.
|
|
|
|
# Postgres superuser password for the vikunja DB.
|
|
POSTGRES_PASSWORD=change-me-very-strong
|
|
|
|
# Must be identical to POSTGRES_PASSWORD — this is how Vikunja connects to it.
|
|
VIKUNJA_DATABASE_PASSWORD=change-me-very-strong
|
|
|
|
# JWT signing secret. Changing it invalidates all existing sessions/tokens.
|
|
VIKUNJA_SERVICE_JWTSECRET=change-me-super-long-random-string
|
|
|
|
# OIDC client secret for the Forgejo provider (config.yml stays secret-free).
|
|
VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET=change-me-forgejo-oidc-client-secret
|