From 46c6c410b96f99f73c2bf0217a6528de924b08ad Mon Sep 17 00:00:00 2001
From: c-d-p <cam.junk@depaoli.id.au>
Date: Thu, 1 May 2025 14:08:20 +0200
Subject: [PATCH] move secrets to env through cicd

---
 .gitea/workflows/deploy.yml                   |   9 ++++++++
 .gitignore                                    |   1 +
 backend/.env.deploy                           |  10 ---------
 .../core/__pycache__/config.cpython-312.pyc   | Bin 1639 -> 1633 bytes
 backend/core/config.py                        |   2 +-
 backend/docker-compose.deploy.yml             |  20 ++++++++++++++++--
 6 files changed, 29 insertions(+), 13 deletions(-)
 delete mode 100644 backend/.env.deploy

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index d3c9b1a..d309948 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -120,6 +120,15 @@ jobs:
       # Deploy to mara
       # ------------------------------------------------------------------
       - name: Deploy Locally
+        env:
+          DB_HOST: ${{ vars.DB_HOST }}
+          DB_USER: ${{ vars.DB_USER }}
+          DB_NAME: ${{ vars.DB_NAME }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          REDIS_URL: ${{ vars.REDIS_URL }}
+          PEPPER: ${{ secrets.PEPPER }}
+          JWT_SECRET_KEY: ${{ secrets.JWT_SECRET_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
         run: |
           #!/bin/bash -ex
 
diff --git a/.gitignore b/.gitignore
index 78a61a4..d4555bc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 # backend
 backend/env
 backend/.env.local
+backend/.env.prod.bak
 backend/db
 backend/redis_data
 
diff --git a/backend/.env.deploy b/backend/.env.deploy
deleted file mode 100644
index 60f6b7d..0000000
--- a/backend/.env.deploy
+++ /dev/null
@@ -1,10 +0,0 @@
-DB_HOST = "db"
-DB_USER = "maia"
-DB_PASSWORD = "Cr7#qVVYF*8s&#jsnay^!EDf5X31Fs"
-DB_NAME = "maia"
-
-REDIS_URL = "redis://redis:6379"
-
-PEPPER = "LsD7%"
-JWT_SECRET_KEY="1c8cf3ca6972b365f8108dad247e61abdcb6faff5a6c8ba00cb6fa17396702bf"
-GOOGLE_API_KEY="AIzaSyBrte_mETZJce8qE6cRTSz_fHOjdjlShBk"
diff --git a/backend/core/__pycache__/config.cpython-312.pyc b/backend/core/__pycache__/config.cpython-312.pyc
index a7972d7fdf1d5b0a933b03338cc3215adbf4d5b7..ea381195aa55409345effa0582ddde9eb669e768 100644
GIT binary patch
delta 43
xcmaFP^N@%4G%qg~0}!aD2xnwW<h{eeuBWH3mzr0$@w-1OOXg)hhsj=SvH%8}3|;^L

delta 74
zcmaFJ^PGqGG%qg~0}#|N6w1h($a{y6S5Hr0FEy`BFDE}aF=yjPe^$l(%Y1GP++Wya
a7$rMuzAyl(j}D9sJR;pzjT}W9K+OPA-4%rZ

diff --git a/backend/core/config.py b/backend/core/config.py
index 26e7a03..20e9357 100644
--- a/backend/core/config.py
+++ b/backend/core/config.py
@@ -2,7 +2,7 @@
 from pydantic_settings import BaseSettings
 import os
 
-DOTENV_PATH = os.path.join(os.path.dirname(__file__), "../.env.local")
+DOTENV_PATH = os.path.join(os.path.dirname(__file__), "../.env")
 
 
 class Settings(BaseSettings):
diff --git a/backend/docker-compose.deploy.yml b/backend/docker-compose.deploy.yml
index ccba056..22c622e 100644
--- a/backend/docker-compose.deploy.yml
+++ b/backend/docker-compose.deploy.yml
@@ -5,6 +5,15 @@ services:
     container_name: MAIA_API
     restart: unless-stopped
     command: uvicorn main:app --host 0.0.0.0 --port 8000
+    environment:
+      DB_HOST: ${DB_HOST}
+      DB_USER: ${DB_USER}
+      DB_NAME: ${DB_NAME}
+      DB_PASSWORD: ${DB_PASSWORD}
+      REDIS_URL: ${REDIS_URL}
+      PEPPER: ${PEPPER}
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
+      GOOGLE_API_KEY: $GOOGLE_API_KEY}
     expose:
       - "8000"
     depends_on:
@@ -12,8 +21,6 @@ services:
       - redis
     networks:
       - default
-    env_file:
-      - ./.env.deploy
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.maia.rule=Host(`maia.depaoli.id.au`)"
@@ -29,6 +36,15 @@ services:
     container_name: MAIA_Worker
     restart: unless-stopped
     command: celery -A core.celery_app worker --loglevel=info
+    environment:
+      DB_HOST: ${DB_HOST}
+      DB_USER: ${DB_USER}
+      DB_NAME: ${DB_NAME}
+      DB_PASSWORD: ${DB_PASSWORD}
+      REDIS_URL: ${REDIS_URL}
+      PEPPER: ${PEPPER}
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
+      GOOGLE_API_KEY: $GOOGLE_API_KEY}
     depends_on:
       - db
       - redis