From 21b239492e0974ab3299fe2349f34e4dfc25f4b2 Mon Sep 17 00:00:00 2001 From: Noa Virellia Date: Sat, 18 Apr 2026 16:37:09 +0800 Subject: [PATCH] chore(container): add build ARGs for Sentry and Turnstile env vars Declare build-time ARG instructions for PUBLIC_TURNSTILE_SITE_KEY, VITE_SENTRY_DSN, SENTRY_DSN, SENTRY_ORG, SENTRY_PROJECT, and SENTRY_AUTH_TOKEN so CI can pass them via --build-arg. TURNSTILE_SECRET_KEY and SENTRY_DSN are runtime-only and injected via -e at container run time. Also removes TURNSTILE_SECRET_KEY from .env.example (runtime secret, not a build-time value). Co-Authored-By: Claude Sonnet 4.6 --- .env.example | 1 - Containerfile | 7 +++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.env.example b/.env.example index 2f870f8..7d600c1 100644 --- a/.env.example +++ b/.env.example @@ -2,7 +2,6 @@ # (Vite dev proxy in dev, Caddy in prod — see vite.config.ts / Caddyfile). # No API_BASE_URL override needed. PUBLIC_TURNSTILE_SITE_KEY=0x4AAAAAACI5pu-lNWFc6Wu1 -TURNSTILE_SECRET_KEY= # Sentry — error monitoring, tracing, session replay, logging # VITE_SENTRY_DSN is public (bundled into the browser build) diff --git a/Containerfile b/Containerfile index cccf968..6779761 100644 --- a/Containerfile +++ b/Containerfile @@ -4,6 +4,12 @@ WORKDIR /srv COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./ RUN pnpm install --frozen-lockfile COPY . . +ARG PUBLIC_TURNSTILE_SITE_KEY +ARG VITE_SENTRY_DSN +ARG SENTRY_DSN +ARG SENTRY_ORG +ARG SENTRY_PROJECT +ARG SENTRY_AUTH_TOKEN RUN pnpm build FROM node:22-alpine AS runtime @@ -11,6 +17,7 @@ WORKDIR /srv ENV NODE_ENV=production ENV PORT=3000 ENV HOST=0.0.0.0 +COPY --from=builder /srv/node_modules ./node_modules COPY --from=builder /srv/build ./build COPY --from=builder /srv/package.json ./ EXPOSE 3000