thermograph/terraform/modules/thermograph-host/templates/thermograph.env.tftpl

# /etc/thermograph.env — RENDERED BY TERRAFORM. Do not edit on the host; change the
# tfvars and re-apply. Read by `docker compose` (interpolation) and loaded into the
# app container (env_file in docker-compose.yml). Mirrors deploy/thermograph.env.example.

# Port uvicorn binds inside the container (compose publishes it on the host).
PORT=${app_port}

# --- Registry pull (repo-split Stage 6) -------------------------------------------
# `docker login` + `docker compose pull` credential -- read:package scope is
# enough (deploy.sh only pulls, never pushes).
REGISTRY_TOKEN=${registry_token}

# --- PostgreSQL (docker-compose stack) ------------------------------------------
# Initializes the db container AND builds the app's THERMOGRAPH_DATABASE_URL.
POSTGRES_PASSWORD=${postgres_password}
# Provided explicitly for parity with the example; the app service also derives this
# from POSTGRES_PASSWORD in docker-compose.yml.
THERMOGRAPH_DATABASE_URL=${database_url}

# --- Container sizing (consumed by docker-compose.yml interpolation) -------------
# Terraform sizes the containers per host. Defaults in compose are 4 / 4 / 2 / 8g.
WORKERS=${workers}
APP_CPUS=${app_cpus}
DB_CPUS=${db_cpus}
DB_MEMORY=${db_memory}
# "latest-pg18" (the default) matches today's behavior. Pin an exact minor before
# any host of this stack could ever replicate with another (docker-compose.yml).
TIMESCALEDB_TAG=${timescaledb_tag}
%{ if openmeteo ~}

# --- Self-hosted Open-Meteo archive (docker-compose.openmeteo.yml) ---------------
# Host rclone mount of the ERA5 object-storage bucket; the overlay bind-mounts it
# into the Open-Meteo containers. THERMOGRAPH_ARCHIVE_URL is set by the overlay.
OM_DATA_DIR=${om_data_dir}
%{ endif ~}

# --- Serving --------------------------------------------------------------------
THERMOGRAPH_BASE=${base}
THERMOGRAPH_BASE_URL=${base_url}
# Secure cookie is only sent over HTTPS: 1 behind Caddy TLS, 0 on a plain-HTTP host.
THERMOGRAPH_COOKIE_SECURE=${cookie_secure}

# --- Auth -----------------------------------------------------------------------
# Signs email-confirm / password-reset tokens; pinned so links survive restarts.
THERMOGRAPH_AUTH_SECRET=${auth_secret}

# --- Ops metrics + IndexNow (Terraform-generated; see ../../secrets.tf) ---------
# Lets the ops dashboard authenticate remotely (over an SSH tunnel or otherwise)
# instead of requiring direct loopback access.
THERMOGRAPH_METRICS_TOKEN=${metrics_token}
# The IndexNow key, published at /{key}.txt as proof of ownership. Freely
# rotatable — nothing external depends on this specific value staying put.
THERMOGRAPH_INDEXNOW_KEY=${indexnow_key}

# --- Web Push (VAPID) -----------------------------------------------------------
# Pinned so existing browser subscriptions keep receiving across restarts.
THERMOGRAPH_VAPID_PRIVATE_KEY=${vapid_private_key}
THERMOGRAPH_VAPID_PUBLIC_KEY=${vapid_public_key}
%{ if vapid_contact != "" ~}
THERMOGRAPH_VAPID_CONTACT=${vapid_contact}
%{ endif ~}

# --- SEO verification (optional) ------------------------------------------------
%{ if google_verify != "" ~}
THERMOGRAPH_GOOGLE_VERIFY=${google_verify}
%{ endif ~}
%{ if bing_verify != "" ~}
THERMOGRAPH_BING_VERIFY=${bing_verify}
%{ endif ~}

# --- Outbound email (optional) --------------------------------------------------
%{ if mail_backend != "" ~}
THERMOGRAPH_MAIL_BACKEND=${mail_backend}
%{ endif ~}
%{ if smtp_host != "" ~}
THERMOGRAPH_SMTP_HOST=${smtp_host}
%{ endif ~}
%{ if smtp_port != "" ~}
THERMOGRAPH_SMTP_PORT=${smtp_port}
%{ endif ~}
%{ if smtp_user != "" ~}
THERMOGRAPH_SMTP_USER=${smtp_user}
%{ endif ~}
%{ if smtp_password != "" ~}
THERMOGRAPH_SMTP_PASSWORD=${smtp_password}
%{ endif ~}
%{ if smtp_starttls != "" ~}
THERMOGRAPH_SMTP_STARTTLS=${smtp_starttls}
%{ endif ~}
%{ if mail_from != "" ~}
THERMOGRAPH_MAIL_FROM=${mail_from}
%{ endif ~}
%{ if mail_reply_to != "" ~}
THERMOGRAPH_MAIL_REPLY_TO=${mail_reply_to}
%{ endif ~}

# --- Discord (optional) ---------------------------------------------------------
%{ if discord_webhook != "" ~}
THERMOGRAPH_DISCORD_WEBHOOK=${discord_webhook}
%{ endif ~}
%{ if discord_public_key != "" ~}
THERMOGRAPH_DISCORD_PUBLIC_KEY=${discord_public_key}
%{ endif ~}
%{ if discord_app_id != "" ~}
THERMOGRAPH_DISCORD_APP_ID=${discord_app_id}
%{ endif ~}
%{ if discord_bot_token != "" ~}
THERMOGRAPH_DISCORD_BOT_TOKEN=${discord_bot_token}
%{ endif ~}
%{ if discord_client_secret != "" ~}
THERMOGRAPH_DISCORD_CLIENT_SECRET=${discord_client_secret}
%{ endif ~}