feat(compose): list the variables a compose file uses in its Environment tab

[agentHits]

Why

The Environment tab of a compose service only showed what was set in the panel. Every ${NAME:-default} in the compose file stayed out of sight until someone opened the file, so it was hard to tell which settings a service has and which values it falls back to.

What changes

A Variables from compose button in the Environment tab of compose services:

1. Fetches the source selected in General (the same clone that Preview Compose and deploys use, for every git provider and for raw files) and reads the compose file.
2. Lists the variables the file uses, each with the default the file falls back to, the services that use it, and whether the environment already sets it. These are marked: credential-like names, defaults that ask to be replaced (change-me), required variables (${NAME:?}), and variables whose default differs from place to place.
3. Puts the selected variables into the editor. Nothing is saved until Save, and a variable that is already set is never changed.

By default the variables are added commented out:

# Defaults from ./docker-compose.yml (branch main).
# Lines starting with # are not applied: remove the # and change the value to override a default.

# Used by web
# HTTP_PORT=8080
# LOG_LEVEL=info

dotenv skips these lines, so the defaults from the file keep applying, and later changes to them in the repository still take effect. Removing the # turns a line into an override. Adding again rewrites the commented lines in place, so they follow the current defaults. A switch adds active lines instead, for a fixed copy of the values.

Details

• Variables are read from the parsed YAML. References inside YAML comments are not listed, and anchors count for the services that use them. $$ is a literal dollar sign. References inside a default (${A:-${B}}) are listed too. APP_NAME, COMPOSE_PROJECT_NAME, COMPOSE_PREFIX and DOCKER_CONFIG are left out because Dokploy writes them itself.
• Values are quoted where dotenv would otherwise cut or change them (#, spaces, quotes, backslashes).
• compose.loadComposeVariables needs service: create (it fetches the source, like fetchSourceType) and envVars: read (defaults are often secrets). It refuses while a deployment is running, because fetching replaces the code directory the build reads from. API keys cannot call it, like revealEnvironment. It is classified write for super sessions.
• Opening the dialog reveals a masked environment first, because a masked editor with unsaved changes cannot be revealed afterwards.
• When Create Environment File is off, the dialog says that the variables do not reach the compose file.

Testing

• New __test__/compose/compose-variables.test.ts: every interpolation form, $$, nested defaults, YAML comments, anchors, conflicting defaults, Dokploy-provided names, placeholders.
• New __test__/compose/compose-env-merge.test.ts: dotenv round trip of quoted values, set variables untouched, in-place refresh of commented lines, grouping by service.
• Access: service-environment-reveal.test.ts checks that the permission check runs before anything is fetched. api-key-output-guard.test.ts checks that API keys are refused.
• tsc --noEmit for apps/dokploy and packages/server; Biome; __test__/compose, __test__/security and __test__/env: 852 tests pass.
• Ran the parser and merge on a real 130-variable compose file. A reference that appears only in a YAML comment is ignored, and active lines round-trip through dotenv unchanged.
• Not yet checked in a browser.

🤖 Generated with Claude Code