Repository navigation
Add required security variables at .env templates #134
Description
Is your feature request related to a problem? Please describe.
The changes applied at cc5934b commit stablish that some security variables are defined as “required”. More specifically: SITMUN_USER_SECRET, MIDDLEWARE_SECRET, SITMUN_MBTILES_JOB_HANDLE_SECRET
These changes require that these three variables are enabled and with data at .env file. If don’t, docker compose can not works and produced the errors showed at the screenshot:
The .env file is created from .env files templates as oracle.env or postgre.env. the .env templates doesn’t contain the definition of SITMUN_USER_SECRET and SITMUN_MBTILES_JOB_HANDLE_SECRET, only contains the MIDDLEWARE_SECRET variable that is commented.
The fact that these variables do not appear in the .env file templates can cause confusion for the user when creating these variables.
Describe the solution you'd like
The .env file templates could contain the definition of the required variables. The documentation could include the need to create the values for these variables using
Additional context
1.2.9 (dev branch)
Activity
fjlopez commentedon Oct 30, 2026
Validation: PARTIAL (evidence:confirmed).
On
dev(8b1a6183), rootdocker-compose.ymlrefuses to start unlessSITMUN_USER_SECRET,MIDDLEWARE_SECRET, andSITMUN_MBTILES_JOB_HANDLE_SECRETare set (:?,cc5934b, #129).README.mdalready documentsopenssl rand -hex 32for all three.setup.shandsetup.ps1append them only when they create a missing.envfromprofiles/development-postgres.env.Gap: every file under
profiles/*.env(postgres.env,oracle.env,development.env,development-postgres.env,development-oracle.env,development-lvh.env) still has only a commented# MIDDLEWARE_SECRET=your-secure-secret-here.SITMUN_USER_SECRETandSITMUN_MBTILES_JOB_HANDLE_SECRETare not named.cp profiles/postgres.env .envorcp profiles/oracle.env .env, thendocker compose up, fails withvariable is required, as reported.setup.shdoes not fill secrets into an.envthat already exists.Templates should name the three keys and point at the existing generate step. They should not store secret values.
fjlopez commentedon Oct 30, 2026
Validation: DONE (evidence:confirmed). Evidence: #136 merged to
devas827fc3cf. Eachprofiles/*.envnamesSITMUN_USER_SECRET,MIDDLEWARE_SECRET, andSITMUN_MBTILES_JOB_HANDLE_SECRETand leaves them unset.tools/scripts/check-compose-secrets.shpassed on that change.