Claude VM
54b78c2dcf
Stripped 35-var environment block from docker-compose.yml to 5 bootstrap
vars (INFISICAL_CLIENT_ID/SECRET, NODE_ENV, PORT, HOSTNAME). All app
secrets now fetched from Infisical /architools at container boot via
docker-entrypoint.sh (modeled on gis-api's pattern, INFISICAL_APP_PATH
=/architools).
- docker-entrypoint.sh: universal-auth login, fetch /architools + /
root, expand ${/VAR} refs, export, exec CMD. Fails loud on Infisical
unreachable (exit 2/3).
- Dockerfile runner: added curl+jq, COPY entrypoint + chmod +x,
ENTRYPOINT ["/app/docker-entrypoint.sh"]
- compose: build args (NEXT_PUBLIC_*) preserved — build-time inlining
into JS bundle. martin/tile-cache/tippecanoe service env blocks
untouched (legacy, removed in Faza E).
Rotation workflow now: Infisical UI -> ssh satra "cd /opt/architools && docker compose up -d --force-recreate architools". Never docker compose restart (does not refetch).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>