dc90e7404b
All checks were successful
Docker / build-and-push (push) Successful in 46s
Was a Vite build-time env var, requiring a second copy of a non-secret value as a separate Gitea CI secret alongside the one already in .env for the api service. Client id isn't sensitive (public in every Spotify authorize URL), so it doesn't need build-time baking at all — now fetched once from a new GET /api/config on the already-running api server, cached client-side after the first call. Collapses config back down to the one place it already lived (the deploy host's .env / docker-compose environment), removes the CI build-arg and its secret entirely. Verified end-to-end: /api/config returns the real client id, and a live guest-login click correctly carries it through into the actual Spotify authorize URL (decoded and checked, not just assumed from the code).
17 lines
741 B
Plaintext
17 lines
741 B
Plaintext
IMAGE=repo.explewd.com/explewd/fullhouse
|
|
HOST_PORT=3080
|
|
|
|
# Spotify app credentials — developer.spotify.com/dashboard. Needs a
|
|
# registered redirect URI matching SPOTIFY_HOST_REDIRECT_URI below
|
|
# exactly (Spotify does exact string matching, trailing slash included),
|
|
# plus a separate one for the guest PKCE flow: <your domain>/ (root,
|
|
# no path — see client/src/lib/pkce.ts).
|
|
#
|
|
# This is the only place SPOTIFY_CLIENT_ID needs configuring — the
|
|
# client fetches it from the api container's /api/config at runtime
|
|
# (it's not sensitive data), not baked in at build time, so there's no
|
|
# separate CI secret for it.
|
|
SPOTIFY_CLIENT_ID=
|
|
SPOTIFY_CLIENT_SECRET=
|
|
SPOTIFY_HOST_REDIRECT_URI=https://fullhouse.yourdomain.com/api/spotify/callback
|