a226cbddbd
`docker compose build` without NEXUS_TOKEN produced a Nexus 401 forty seconds in, worded as a credentials problem when it was really an unset variable. The mount's `required=true` asserts the secret was *declared*, not that it holds anything, so an empty one sailed past it and npm sent an empty `_authToken`. The install moves to tools/docker-install-deps.sh, which checks the secret before touching the network and fails in under a second with the three ways to supply it. It is a file rather than inline shell because BuildKit echoes an inline command twice on failure and buries the message. Also ignore .env. It carries NEXUS_TOKEN, compose reads it at build time, and it was not gitignored — .env.example stays tracked. Nothing had been committed: the only prior commit predates all of this. Verified: empty token fails in 0.2s with the message; .env and the environment variable both build; the image carries no trace of the token and serves the full page. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
20 lines
853 B
Plaintext
20 lines
853 B
Plaintext
# Copy to `.env`. Compose reads it on its own — for the runtime settings below
|
|
# and for the build-time token. `.env` is gitignored; this file is not.
|
|
|
|
# Base URL of the Pireon API, without a trailing slash. Read on the server only:
|
|
# the browser never talks to the API directly.
|
|
PIREON_API_URL=https://landing-api.pireon.dev/api
|
|
|
|
# Host port the container is published on. Change it if something else already
|
|
# holds 3000 on the machine — the container always listens on 3000 internally.
|
|
LANDING_PORT=3000
|
|
|
|
# Needed only to *build* the image: `@pi/ui` comes from the private Nexus.
|
|
# Locally this is the value already sitting in ~/.npmrc:
|
|
#
|
|
# grep nexus.pireon.dev ~/.npmrc
|
|
#
|
|
# Never baked into a layer — it is mounted as a BuildKit secret. An empty value
|
|
# fails the build immediately with an explanation rather than a Nexus 401.
|
|
NEXUS_TOKEN=
|