The key used to be a fresh randomBytes() on every process start, by
design — but that means every restart invalidates whatever's saved in
a password manager or bookmarked admin session. Now it's generated
once and written to backend/.env (ADMIN_API_KEY=...) on first launch,
then read back from there on every later launch. An explicit
ADMIN_API_KEY env var still wins outright, for Docker deployments that
have no writable .env inside the container — wired an optional
pass-through into both compose files for that case, since without it
they'd keep regenerating on every recreate regardless of this change.
Updated the handful of comments (server.ts, widgets/install.ts,
index.ts's startup banner, .env.example) that documented the old
every-restart-regenerates behavior as a load-bearing security property.
docker-compose.yml's backend/frontend services now carry an image: name
pointed at git.salastil.com/salastil/homefeed-{backend,frontend}, so
compose build/push/pull all target the right place — overridable via
REGISTRY/IMAGE_TAG in .env for a different registry or a specific tag.
.gitea/workflows/docker-build.yml builds and pushes both images on
every push to master/development (latest on master, branch name +
commit SHA otherwise), using Gitea Actions' GitHub Actions-compatible
runner and its built-in GITHUB_TOKEN alias for registry auth. The
frontend build pulls VITE_BACKEND_URL from the repo's Actions
variables rather than hardcoding it, since that needs to be the real
public URL.
Multi-stage Dockerfiles for both (build stage with devDependencies,
slim production runtime), a root docker-compose.yml wiring them
together, and a root .env.example documenting the compose-level vars.
The frontend container runs with network_mode: service:backend rather
than its own network — VITE_BACKEND_URL is baked into the frontend
bundle at build time and used by both the visitor's browser and this
container's own server-rendered (SSR) fetches on a page's first load;
sharing the backend's network namespace is what lets a single
http://localhost:4000 value correctly resolve for both, since no
Compose-internal service-name hostname is reachable from a browser and
no host-only address is reachable from inside a separate container.
Backend gets a healthcheck (plain node -e fetch, no extra deps) so
depends_on: condition: service_healthy actually waits for it to be
ready rather than just started. backend-data volume persists the
SQLite DB, downloaded media, and uploaded widgets across restarts.
Added a root README "Docker" section and a root .gitignore for the
compose .env file.
Salastil
Claude