Summary
loadFileSecrets() (src/server.ts) scans every env var ending in _FILE and dereferences it as a gittensory Docker-secret pointer (readFileSync the value, assign the trimmed contents to the _FILE-stripped name). It has no exclusion for Docker Compose's own reserved COMPOSE_FILE var — a :-delimited list of compose file paths (e.g. docker-compose.yml:docker-compose.override.yml:docker-compose.local-gpu.yml), completely unrelated to gittensory's secret convention.
Area
Cloudflare deploy/runtime
Expected behavior
loadFileSecrets() should only dereference _FILE vars that are actually gittensory's own Docker-secret convention. Docker Compose's own reserved _FILE-suffixed vars should be left untouched, so a normal docker compose boot produces no error log for them.
Actual behavior
COMPOSE_FILE is picked up by the _FILE scan like any other var. readFileSync throws because a colon-separated multi-path string is never a valid single path, and the catch block logs a level:"error" structured line on every container boot:
{"level":"error","event":"selfhost_secret_file_unreadable","var":"COMPOSE_FILE"}
This is harmless in effect (COMPOSE_FILE was never meant to be dereferenced), but it is a real alerting-hygiene bug: this codebase relies on level:"error" structured logs as the actual signal for Sentry-visible operator alerts. A guaranteed false alarm on every restart trains operators to treat error-level logs from this function as noise, undermining that convention.
Reproduction
Boot the self-host image under docker compose in a setup where COMPOSE_FILE is present in the container's environment (e.g. an operator's .env sets COMPOSE_FILE=docker-compose.yml:docker-compose.override.yml:... to combine multiple compose files, and that same .env is also loaded into the gittensory service via env_file:) and check the boot logs for selfhost_secret_file_unreadable / "var":"COMPOSE_FILE".
Validation
N/A (filing). A fix should exclude COMPOSE_FILE (and any other well-known non-secret _FILE-suffixed var Docker/Compose itself reserves) from the dereference scan, with a regression test that reproduces the false-positive log and pins the fix.
Summary
loadFileSecrets()(src/server.ts) scans every env var ending in_FILEand dereferences it as a gittensory Docker-secret pointer (readFileSyncthe value, assign the trimmed contents to the_FILE-stripped name). It has no exclusion for Docker Compose's own reservedCOMPOSE_FILEvar — a:-delimited list of compose file paths (e.g.docker-compose.yml:docker-compose.override.yml:docker-compose.local-gpu.yml), completely unrelated to gittensory's secret convention.Area
Cloudflare deploy/runtime
Expected behavior
loadFileSecrets()should only dereference_FILEvars that are actually gittensory's own Docker-secret convention. Docker Compose's own reserved_FILE-suffixed vars should be left untouched, so a normaldocker composeboot produces no error log for them.Actual behavior
COMPOSE_FILEis picked up by the_FILEscan like any other var.readFileSyncthrows because a colon-separated multi-path string is never a valid single path, and the catch block logs alevel:"error"structured line on every container boot:This is harmless in effect (
COMPOSE_FILEwas never meant to be dereferenced), but it is a real alerting-hygiene bug: this codebase relies onlevel:"error"structured logs as the actual signal for Sentry-visible operator alerts. A guaranteed false alarm on every restart trains operators to treat error-level logs from this function as noise, undermining that convention.Reproduction
Boot the self-host image under
docker composein a setup whereCOMPOSE_FILEis present in the container's environment (e.g. an operator's.envsetsCOMPOSE_FILE=docker-compose.yml:docker-compose.override.yml:...to combine multiple compose files, and that same.envis also loaded into thegittensoryservice viaenv_file:) and check the boot logs forselfhost_secret_file_unreadable/"var":"COMPOSE_FILE".Validation
N/A (filing). A fix should exclude
COMPOSE_FILE(and any other well-known non-secret_FILE-suffixed var Docker/Compose itself reserves) from the dereference scan, with a regression test that reproduces the false-positive log and pins the fix.