ed6b568d60
Two silent failures sitting between Phase A and a working invitation. The compose file never passed MAIL_* through. Compose does not give a container the contents of .env — it only substitutes into the compose file — so the settings could be filled in correctly and read by nobody, with the app reporting mail as unconfigured and the values sitting right there on disk. test_deployment.py now fails the build whenever .env.example and docker-compose.yml drift apart, which is how this happened and how it would happen again. The app's code is baked into the image (COPY apps /srv/apps), so a pull followed by --force-recreate runs the old code and says nothing. Added scripts/deploy-board.sh: rebuild, sync the compose file, restart, print the log, and name any setting present in .env.example and missing from the live .env. It never touches .env itself. Also: "no mail server configured" is now told apart from "the mail server refused". They want different things done about them, and the first one sent an admin looking for an SMTP error that never existed. The new-member form says so before it is filled in rather than after. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NizVpJ2dwzCbjCrTLCjeHn
59 lines
2.5 KiB
YAML
59 lines
2.5 KiB
YAML
# Members area — Flask + SQLite behind Caddy.
|
|
#
|
|
# Copy this directory to /srv/board/ on the server, fill in .env, then:
|
|
# mkdir -p /srv/board/data && sudo chown 1000:1000 /srv/board/data
|
|
# docker compose up -d
|
|
#
|
|
# Bound to localhost like Gitea and Woodpecker: the only way in from outside is
|
|
# through Caddy, which terminates TLS and forwards /comunidad/.
|
|
|
|
services:
|
|
board:
|
|
image: vienalatina/board:1
|
|
restart: unless-stopped
|
|
environment:
|
|
# Session signing key. Generate once with `openssl rand -hex 32`.
|
|
# Changing it signs everyone out; losing it means nothing worse.
|
|
- BOARD_SECRET_KEY=${BOARD_SECRET_KEY}
|
|
|
|
# Gitea OAuth2 application — a CONFIDENTIAL client, unlike the Decap one.
|
|
- GITEA_URL=https://git.vienalatina.com
|
|
- BOARD_OAUTH_CLIENT_ID=${BOARD_OAUTH_CLIENT_ID}
|
|
- BOARD_OAUTH_CLIENT_SECRET=${BOARD_OAUTH_CLIENT_SECRET}
|
|
- BOARD_BASE_URL=https://vienalatina.com
|
|
|
|
# The Gitea username that becomes the one owner, applied once on an empty
|
|
# database. Changing it later does nothing: ownership moves from inside
|
|
# the app, so nobody can take it by editing this file.
|
|
- BOARD_OWNER=${BOARD_OWNER}
|
|
|
|
# Site-admin token, used only to create Gitea accounts for new members.
|
|
# This is the most privileged secret on the box after Gitea's own
|
|
# database: anything that can read this environment can create accounts.
|
|
# Leave it empty to run without account creation — admins then add people
|
|
# who already have a Gitea login, and everything else still works.
|
|
- GITEA_ADMIN_TOKEN=${GITEA_ADMIN_TOKEN:-}
|
|
|
|
- BOARD_DB=/data/board.db
|
|
|
|
# Outgoing mail, for invitations and password resets. Empty MAIL_HOST is
|
|
# a supported state: the members area still works, but nobody can be
|
|
# invited or recover a password, and the screens say so.
|
|
#
|
|
# Every one of these has to be listed here. Compose does not hand the
|
|
# contents of .env to the container by itself — it only substitutes into
|
|
# this file — so a variable added to .env and not added here is read by
|
|
# nobody, and the app reports mail as unconfigured with the settings
|
|
# sitting right there on disk.
|
|
- MAIL_HOST=${MAIL_HOST:-}
|
|
- MAIL_PORT=${MAIL_PORT:-587}
|
|
- MAIL_SECURITY=${MAIL_SECURITY:-starttls}
|
|
- MAIL_USER=${MAIL_USER:-}
|
|
- MAIL_PASSWORD=${MAIL_PASSWORD:-}
|
|
- "MAIL_FROM=${MAIL_FROM:-Viena Latina <hola@vienalatina.com>}"
|
|
|
|
volumes:
|
|
- ./data:/data
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|