From dc40faf5df54ae5d43e67bdd1fe297a1a9e70242 Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Tue, 26 May 2026 18:07:15 +0300 Subject: [PATCH] deploy: write invoicing env vars to .env MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extends the .env heredoc the workflow drops on the prod host with: - ADMIN_USER / ADMIN_PASSWORD — gate /admin/* - DATABASE_URL — points at the storage stack's Postgres - S3_* (endpoint, bucket, creds) — MinIO; S3_PUBLIC_ENDPOINT is the s3.asxp.io hostname used only for presigning so browser-facing URLs resolve over Traefik+TLS. Non-secret values stay hardcoded in the workflow; secrets come from Forgejo. ASXPIO_DB_PASSWORD / S3 creds must match the corresponding secrets on the storage repo or the app can't authenticate. --- .forgejo/workflows/deploy.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml index 32737d3..bd14a2a 100644 --- a/.forgejo/workflows/deploy.yaml +++ b/.forgejo/workflows/deploy.yaml @@ -61,11 +61,16 @@ jobs: env: SESSION_SECRET: ${{ secrets.SESSION_SECRET }} SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }} + ADMIN_USER: ${{ secrets.ADMIN_USER }} + ADMIN_PASSWORD: ${{ secrets.ADMIN_PASSWORD }} + ASXPIO_DB_PASSWORD: ${{ secrets.ASXPIO_DB_PASSWORD }} + ASXPIO_S3_ACCESS_KEY: ${{ secrets.ASXPIO_S3_ACCESS_KEY }} + ASXPIO_S3_SECRET_KEY: ${{ secrets.ASXPIO_S3_SECRET_KEY }} with: host: ${{ secrets.DEPLOY_IP }} username: ${{ secrets.DEPLOY_USER }} key: ${{ secrets.DEPLOY_SSH_KEY }} - envs: SESSION_SECRET,SMTP_PASSWORD + envs: SESSION_SECRET,SMTP_PASSWORD,ADMIN_USER,ADMIN_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY script_stop: true script: | umask 077 @@ -79,6 +84,15 @@ jobs: SMTP_PASSWORD=${SMTP_PASSWORD} MAIL_FROM=IE Sergei Poljanski Contact Form MAIL_TO=ie@asxp.io + ADMIN_USER=${ADMIN_USER} + ADMIN_PASSWORD=${ADMIN_PASSWORD} + DATABASE_URL=postgres://asxpio:${ASXPIO_DB_PASSWORD}@postgres:5432/asxpio + S3_ENDPOINT=http://minio:9000 + S3_PUBLIC_ENDPOINT=https://s3.asxp.io + S3_REGION=us-east-1 + S3_BUCKET=asxpio-invoices + S3_ACCESS_KEY=${ASXPIO_S3_ACCESS_KEY} + S3_SECRET_KEY=${ASXPIO_S3_SECRET_KEY} EOF chmod 600 /opt/asxpio/.env