halkyon/deploy/.env.example

# Copy to deploy/.env, restrict it (chmod 600), and fill in. deploy/.env is git-ignored
# and never goes into an image. How it reaches sahaquiel is decided when the server is
# set up (e.g. rendered from Proton Pass on the deploying machine and copied over SSH,
# so the server itself never holds Proton credentials).

# `http://localhost` for the local rehearsal; `learn.halkyon.eu` on sahaquiel.
DOMAIN=http://localhost

# Postgres password, shared by the postgres and server services.
# Generate: openssl rand -base64 32
POSTGRES_PASSWORD=

# Pepper for hashing session keys (server-side sessions). NEVER change it once
# sessions exist: everyone would be signed out, and anonymous accounts can't sign
# back in. Rotation only via fallbackSessionKeyHashPeppers.
# Generate: openssl rand -base64 32
SESSION_KEY_HASH_PEPPER=
feat(deploy): Docker Compose stack for the instance Caddy, the Serverpod server and PostgreSQL 16 in deploy/. Only Caddy publishes ports; the server and Postgres are reachable only inside the Compose network (Docker bypasses ufw, and the server listens on every interface). Secrets come from deploy/.env as environment variables; there is no production passwords.yaml, and .dockerignore keeps local secrets out of the build context. The server image builds on Serverpod's template with an Ubuntu 24.04 runtime: complete glibc incl. libgcc_s for the SQLite libraries Serverpod 4 bundles, CA certificates, a non-root user, and exec so SIGTERM reaches the server. The scaffold's dev-only docker-compose.yaml is removed. Verified locally: image builds, all native libraries resolve, no passwords.yaml in the image, migrations apply at start, Caddy serves 200, port 8080 unreachable from the host, Postgres in UTC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-09-27 17:18:31 +02:00			`# Copy to deploy/.env, restrict it (chmod 600), and fill in. deploy/.env is git-ignored`
			`# and never goes into an image. How it reaches sahaquiel is decided when the server is`
			`# set up (e.g. rendered from Proton Pass on the deploying machine and copied over SSH,`
			`# so the server itself never holds Proton credentials).`

			# `http://localhost` for the local rehearsal; `learn.halkyon.eu` on sahaquiel.
			`DOMAIN=http://localhost`

			`# Postgres password, shared by the postgres and server services.`
			`# Generate: openssl rand -base64 32`
			`POSTGRES_PASSWORD=`

			`# Pepper for hashing session keys (server-side sessions). NEVER change it once`
			`# sessions exist: everyone would be signed out, and anonymous accounts can't sign`
			`# back in. Rotation only via fallbackSessionKeyHashPeppers.`
			`# Generate: openssl rand -base64 32`
			`SESSION_KEY_HASH_PEPPER=`