From 1129fcae6f3122475ab193ab5cefc7ce4a757de5 Mon Sep 17 00:00:00 2001 From: John O'Keefe Date: Wed, 29 Jul 2026 16:02:32 -0400 Subject: [PATCH] fix(compose): make BASE_URL/COOKIE_SECURE configurable, drop obsolete version Address compose issues surfaced on first production deploy: - Remove obsolete `version: "3.8"` (ignored by Compose v2; caused a warning). - Fix BASE_URL: it used compose-time interpolation of ${SERVER_PORT}, which is only defined as a runtime container env var (invisible to interpolation) and absent from .env. This resolved to an empty string, producing a broken `http://localhost:` (no port) and a startup warning. Now ${BASE_URL:-http://localhost:8765}, overridable per-deployment via .env. - Move COOKIE_SECURE from the db service to the app service and make it configurable (${COOKIE_SECURE:-false}). It controls the session cookie Secure flag, an app concern; on the db service it was a no-op, so the app never received it and cookies were always non-secure. Set COOKIE_SECURE=true behind a TLS-terminating reverse proxy (Caddy/nginx/traefik), where the app speaks plain HTTP internally. - Image reference unchanged: ${IMAGE_TAG:-latest} (no hardcoded version). --- docker-compose.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index c43d3e5..1e794e4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,5 +1,3 @@ -version: "3.8" - services: # PostgreSQL Database db: @@ -9,7 +7,6 @@ services: POSTGRES_DB: bookhoard POSTGRES_USER: postgres POSTGRES_PASSWORD: ${DBPASS} - COOKIE_SECURE: false # make true in production with HTTPS volumes: - postgres_data:/var/lib/postgresql/data - ./database/schema:/docker-entrypoint-initdb.d @@ -47,7 +44,9 @@ services: # Local: http://localhost:8765 # Local network: http://192.168.1.X:8765 # Domain: https://bookhoard.example.com - BASE_URL: http://localhost:${SERVER_PORT} + BASE_URL: ${BASE_URL:-http://localhost:8765} + # Mark session cookies Secure; set true behind a TLS-terminating reverse proxy (Caddy/nginx/traefik) + COOKIE_SECURE: ${COOKIE_SECURE:-false} # Rate Limiting Configuration TEST_MODE: ${TEST_MODE:-false}