davidherranandClaude Fable 5.1
04253cba2b
Arkhos's audit (2026-09-02) closed the credential alarm: the client rotated every key, so the
blob in history is history, not exposure. What remained was the PATTERN — a file named `env`
under version control, in a repo other Origin sites read as a template.
Measured before changing anything:
- docker-compose.yml never references `env`; it substitutes ${VARS} from a git-ignored `.env`.
- The tracked `env` lacks DB_USER/DB_PASSWORD/DB_NAME that compose requires, so no deployment
can be reading it. Untracking it deletes nothing a VPS `git pull` depends on.
Changes:
- `git rm --cached env` (history untouched; the dead values stay where they were).
- `.gitignore`: `env` (the existing `.env*` rule never matched a dotless name).
- `env.example`: every key compose substitutes, placeholder values only.
- README.md: the environment note Arkhos suggested, plus the deploy one-liner.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
20 lines
763 B
Markdown
20 lines
763 B
Markdown
# Flux SRL — rf-flux.com
|
|
|
|
Next.js 16 + AI SDK 6 + Prisma 7 + PostgreSQL, shipped as Docker containers behind Nginx.
|
|
Delivered to the client; kept here for support and as a reference for other Origin sites.
|
|
|
|
## Environment
|
|
|
|
`docker-compose.yml` reads its `${VARS}` from a git-ignored `.env`. `env.example` lists every
|
|
key. **Do not track environment files.** A file literally named `env` exists in this repo's
|
|
history (4 commits); the client has since rotated every credential in it, so the values are dead —
|
|
if you use this repo as a template, do not replicate that pattern.
|
|
|
|
## Deploy (VPS)
|
|
|
|
```bash
|
|
cd /opt/flux-srl && git pull && docker compose up -d --build app
|
|
```
|
|
|
|
Migrations run from the container entrypoint. Reload Nginx only when `nginx/*` changes.
|