From 920ab2fb736f1b9e5148091d41e08b642d26849f Mon Sep 17 00:00:00 2001
From: AdrianoDev <adrianodalpastro@gmail.com>
Date: Mon, 21 Sep 2026 22:28:50 +0200
Subject: [PATCH] deploy(compose): segreti obbligatori in produzione, senza
 default (#33)

docker-compose.yml: DB_ROOT_PASSWORD, DB_PASSWORD, SERVER_SECRET_KEY,
CLIENT_SECRET_KEY senza default, `config` si rifiuta se mancano.
docker-compose.dev.yml resta con i default (sviluppo). .env.example
documenta l'obbligo in produzione.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .env.example       | 7 +++++++
 docker-compose.yml | 6 ++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index 5b3237c..faf29ff 100644
--- a/.env.example
+++ b/.env.example
@@ -3,6 +3,8 @@
 # ===========================
 
 # --- Database ---
+# DB_PASSWORD e DB_ROOT_PASSWORD (sezione Docker sotto): in produzione (docker-compose.yml)
+# sono obbligatorie, senza default — `docker compose config` si rifiuta se mancano.
 DB_HOST=localhost
 DB_PORT=3306
 DB_NAME=tiemeasureflow
@@ -10,12 +12,16 @@ DB_USER=tmflow
 DB_PASSWORD=change_me_in_production
 
 # --- Server ---
+# SERVER_SECRET_KEY: in produzione obbligatoria, senza default, e il server rifiuta
+# di avviarsi se resta uguale al valore committato qui sotto.
 SERVER_HOST=0.0.0.0
 SERVER_PORT=8000
 SERVER_SECRET_KEY=change-this-to-a-random-secret-key
 SERVER_CORS_ORIGINS=http://localhost:5000
 
 # --- Client ---
+# CLIENT_SECRET_KEY: in produzione obbligatoria, senza default, e il client rifiuta
+# di avviarsi se resta uguale al valore committato qui sotto.
 CLIENT_HOST=0.0.0.0
 CLIENT_PORT=5000
 CLIENT_SECRET_KEY=change-this-to-another-random-secret-key
@@ -54,6 +60,7 @@ OPENROUTER_API_KEY=  # API key per parsing schede tecniche, vuoto = disabilitato
 OPENROUTER_MODEL=anthropic/claude-sonnet-4  # Modello AI da utilizzare
 
 # --- Docker ---
+# DB_ROOT_PASSWORD: in produzione (docker-compose.yml) obbligatoria, senza default.
 DB_ROOT_PASSWORD=root_password_change_me
 NGINX_PORT=80
 NGINX_SSL_PORT=443
diff --git a/docker-compose.yml b/docker-compose.yml
index 57d5c71..2b74fa2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,10 +4,10 @@ services:
     container_name: tmflow-mysql
     restart: unless-stopped
     environment:
-      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-root_password_change_me}
+      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:?manca DB_ROOT_PASSWORD}
       MYSQL_DATABASE: ${DB_NAME:-tiemeasureflow}
       MYSQL_USER: ${DB_USER:-tmflow}
-      MYSQL_PASSWORD: ${DB_PASSWORD:-change_me_in_production}
+      MYSQL_PASSWORD: ${DB_PASSWORD:?manca DB_PASSWORD}
     volumes:
       - mysql_data:/var/lib/mysql
     command: >
@@ -34,6 +34,7 @@ services:
       DB_HOST: mysql
       UPLOAD_DIR: uploads
       VISION_WORKER_URL: http://vision:8100
+      SERVER_SECRET_KEY: ${SERVER_SECRET_KEY:?manca SERVER_SECRET_KEY}
     volumes:
       - upload_data:/app/uploads
     depends_on:
@@ -78,6 +79,7 @@ services:
       - .env
     environment:
       API_SERVER_URL: http://server:8000
+      CLIENT_SECRET_KEY: ${CLIENT_SECRET_KEY:?manca CLIENT_SECRET_KEY}
     depends_on:
       - server
     labels: