feat: fix env vars and tidy - #11
Merged
Merged
Conversation
CHATWOOT_MAC_TOKEN and CHATWOOT_BASE_URL are pure passthroughs used by the hosted app for Chatwoot support auth; when unset in .env, Compose substitutes empty strings and the web app treats them as disabled. Same pattern as Stripe, Loops, S3, etc.
haraka/haraka_config/config/me holds the SMTP greeting hostname, which is per-deployment, yet it was both tracked in git and listed in .gitignore. That made git status permanently dirty on every deployment and a careless 'git checkout .' would clobber the real hostname back to 'Shroud.email'. Untrack it (the .gitignore entry already keeps the local copy on disk), and ship a tracked me.example template instead. Self-hosters copy it to me and set their hostname. .gitignore is unchanged.
Caddy is now built locally (caddy/Dockerfile) with xcaddy v2.10.0, bundling caddy-permissive-file-storage (pinned to commit 4059a60, the PR #1 fix for the modern context-based Store() signature — not yet released as a tag) and caddy-dns/bunny v1.2.0. Self-hosters keep the default HTTP-01 ACME (caddy/Caddyfile unchanged). DNS-01 via Bunny is opt-in: set BUNNY_API_KEY and CADDYFILE_PATH=./caddy/Caddyfile.bunny in .env. The compose caddy service now builds from ./caddy, passes BUNNY_API_KEY through, and mounts ${CADDYFILE_PATH:-./caddy/Caddyfile} so the active Caddyfile is selectable without editing compose. Verified: image builds, caddy version v2.10.0, both caddy.storage.permissive_file_storage and dns.providers.bunny modules present, and both Caddyfile and Caddyfile.bunny validate.
Switch the Dockerfile pin from commit 4059a60 to @main, matching the repo's prior rolling-:main approach. The PR #1 "Update for current Caddy" fix lives on main; tracking main means we pick up future fixes without manual pin bumps. Rebuilt and verified: caddy v2.10.0, both permissive_file_storage and bunny modules present, both Caddyfiles validate.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="caddy/Dockerfile">
<violation number="1" location="caddy/Dockerfile:14">
P2: Build reproducibility and supply-chain risk: pinning to `@main` instead of a specific commit hash makes the build non-deterministic. Every `docker compose up --build caddy` run pulls whatever is latest on the upstream `main` branch at that moment, so two builds at different times may produce different Caddy binaries — and any push to that repo's `main` (even an accidental force-push or a future incompatible change) could silently break the build for all self-hosters. The previous pin to commit `4059a602` was more robust. Consider restoring a commit-hash pin and keeping the explicit `Replace with @v0.1.5` reminder, so there is a stable known-good point while awaiting the release.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| FROM caddy:2.10-builder AS builder | ||
|
|
||
| RUN xcaddy build v2.10.0 \ | ||
| --with github.com/Shroud-email/caddy-permissive-file-storage@main \ |
There was a problem hiding this comment.
P2: Build reproducibility and supply-chain risk: pinning to @main instead of a specific commit hash makes the build non-deterministic. Every docker compose up --build caddy run pulls whatever is latest on the upstream main branch at that moment, so two builds at different times may produce different Caddy binaries — and any push to that repo's main (even an accidental force-push or a future incompatible change) could silently break the build for all self-hosters. The previous pin to commit 4059a602 was more robust. Consider restoring a commit-hash pin and keeping the explicit Replace with @v0.1.5 reminder, so there is a stable known-good point while awaiting the release.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At caddy/Dockerfile, line 14:
<comment>Build reproducibility and supply-chain risk: pinning to `@main` instead of a specific commit hash makes the build non-deterministic. Every `docker compose up --build caddy` run pulls whatever is latest on the upstream `main` branch at that moment, so two builds at different times may produce different Caddy binaries — and any push to that repo's `main` (even an accidental force-push or a future incompatible change) could silently break the build for all self-hosters. The previous pin to commit `4059a602` was more robust. Consider restoring a commit-hash pin and keeping the explicit `Replace with @v0.1.5` reminder, so there is a stable known-good point while awaiting the release.</comment>
<file context>
@@ -4,14 +4,14 @@
RUN xcaddy build v2.10.0 \
- --with github.com/Shroud-email/caddy-permissive-file-storage@4059a602db55a1762de165dac7f1204c823ebbd4 \
+ --with github.com/Shroud-email/caddy-permissive-file-storage@main \
--with github.com/caddy-dns/bunny@v1.2.0
</file context>
Suggested change
| --with github.com/Shroud-email/caddy-permissive-file-storage@main \ | |
| --with github.com/Shroud-email/caddy-permissive-file-storage@4059a602db55a1762de165dac7f1204c823ebbd4 \ |
Prod's known-working config only uses Bunny DNS-01 for APP_DOMAIN; the email domain stays on issuer acme (HTTP-01). The Bunny variant was stricter than prod and would require Bunny to be authoritative DNS for EMAIL_DOMAIN too. Revert that one block to match prod — only APP_DOMAIN uses dns bunny.
taobojlen
changed the title
Watchtower 1.7.1's Docker SDK defaults to Docker API version 1.25, too old for Docker Engine 28+. On modern hosts the override silently fails to talk to dockerd. Pin the API version explicitly via DOCKER_API_VERSION=1.44 in the watchtower service environment list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The main things to be aware of here are (sorry for the LLM text):
1. Untrack per-deployment Haraka
mehostname, ship templateharaka/haraka_config/config/meholds the SMTP greeting hostname, which is per-deployment, yet it was both tracked in git and listed in.gitignore. That madegit statuspermanently dirty on every deployment, and a carelessgit checkout .would clobber the real hostname back toShroud.email.git rm --cachedthe file (the existing.gitignoreentry keeps the local copy on disk).me.exampletemplate (one line:example.com)..gitignoreis unchanged (it already ignoresme).2. Opt-in Bunny DNS-01 TLS for Caddy
Caddy is now built locally (
caddy/Dockerfile) withxcaddy build v2.10.0, bundling:caddy-permissive-file-storage— world-readable certs so the cron sidecar can bundle them for Harakacaddy-dns/bunnyv1.2.0 — DNS-01 ACME via Bunny.net, opt-in.DNS-01 via Bunny is opt-in:
BUNNY_API_KEYin.env.CADDYFILE_PATH=./caddy/Caddyfile.bunnyin.env.docker compose up -d --build caddy.