Secrets e variabili
Regola generale
Nessuna password o chiave nel repository. Usare .env locale (gitignored) e secrets GitHub/Dokploy.
Development (.env)
| Variabile | Descrizione |
|---|---|
EZ_ENV | development |
SITE_NAME | Nome site Frappe |
ADMIN_PASSWORD | Password Administrator |
DB_ROOT_PASSWORD | Root MariaDB |
DB_PASSWORD | Password utente DB |
HTTP_PUBLISH_PORT | Porta HTTP locale (default 8001) |
Template: .env.example, deploy/env/.env.development.example
Staging / Production
| Variabile | Descrizione |
|---|---|
CUSTOM_IMAGE | ghcr.io/<org>/ez-factoryos |
CUSTOM_TAG | sha-<commit> o digest |
SECRET_KEY | Encryption key site |
WEB_URL | URL pubblico HTTPS |
CORS_ALLOWED_ORIGINS | Origini CORS |
DB_ROOT_PASSWORD | Root MariaDB |
DB_PASSWORD | Password DB site |
Template: deploy/env/.env.staging.example, deploy/env/.env.production.example
GitHub Secrets
| Secret | Environment | Uso |
|---|---|---|
GITHUB_TOKEN | repo | Push GHCR (automatico) |
DOKPLOY_WEBHOOK_DEV | development | Deploy dev |
DOKPLOY_WEBHOOK_STAGING | staging | Deploy staging |
DOKPLOY_WEBHOOK_PRODUCTION | production | Deploy production |
COOLIFY_DEPLOY_TOKEN | staging/production | Bearer token webhook Coolify |
COOLIFY_DOCS_WEBHOOK | repo | Deploy docs VitePress (docs.factoryos.ezbit.it) |
BACKUP_WEBHOOK_STAGING | staging | Backup obbligatorio pre-deploy |
BACKUP_WEBHOOK_PRODUCTION | production | Backup obbligatorio pre-deploy |
ROLLBACK_WEBHOOK_PRODUCTION | production | Rollback automatico opzionale |
DOKPLOY_API_URL | repo | API Dokploy (futuro) |
DOKPLOY_API_TOKEN | repo | Token API Dokploy |
S3_ACCESS_KEY_ID | staging/production | Backup S3 |
S3_SECRET_ACCESS_KEY | staging/production | Backup S3 |
Generazione segreti
bash
openssl rand -hex 32