fix: inject per-app credentials into deploy/.env during deploy

The deploy workflow sourced per-app credentials but never wrote them
into deploy/.env, so the container never received them. Now sed patches
DATABASE_URL, S3_ACCESS_KEY, S3_SECRET_KEY, and S3_BUCKET after sourcing
the credentials file. Also updates env.template to reflect per-app pattern.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baijum

.github/workflows/deploy.yml

@@ -44,6 +44,25 @@ jobs:
               || docker compose -f /opt/platform/docker-compose.yml exec -T postgres \
               psql -U postgres -c "CREATE DATABASE ${APP_DB}"
 
+            # Source per-app credentials and update deploy/.env if available
+            CREDENTIALS_FILE="/opt/platform/credentials/${APP_NAME}.env"
+            if [ -f "$CREDENTIALS_FILE" ]; then
+              echo "Using per-app credentials from $CREDENTIALS_FILE"
+              source "$CREDENTIALS_FILE"
+              # Update DATABASE_URL with per-app user credentials
+              sed -i "s|^DATABASE_URL=.*|DATABASE_URL=postgresql://${DB_USER}:${DB_PASSWORD}@postgres:5432/${APP_DB}|" deploy/.env
+              # Update S3 credentials with per-app MinIO user
+              sed -i "s|^S3_ACCESS_KEY=.*|S3_ACCESS_KEY=${S3_ACCESS_KEY}|" deploy/.env
+              sed -i "s|^S3_SECRET_KEY=.*|S3_SECRET_KEY=${S3_SECRET_KEY}|" deploy/.env
+              # Update S3 bucket name
+              sed -i "s|^S3_BUCKET=.*|S3_BUCKET=${APP_NAME}-uploads|" deploy/.env
+              echo "deploy/.env updated with per-app credentials"
+            else
+              echo "WARNING: Per-app credentials not found at $CREDENTIALS_FILE"
+              echo "Run create-app-credentials.sh ${APP_NAME} for isolated credentials."
+              echo "Falling back to existing deploy/.env credentials."
+            fi
+
             # Build and start app containers (project name = app name for predictable container names)
             docker compose -p ${APP_NAME} -f deploy/docker-compose.yml up -d --build
 

deploy/env.template

@@ -1,10 +1,11 @@
 # Copy this file to .env and fill in real values before first deploy.
-# Credentials come from /opt/platform/.env on the server.
+# Per-app credentials are generated by create-app-credentials.sh on the server.
+# See /opt/platform/credentials/<app-name>.env for generated values.
 
 APP_DOMAIN=app.example.com
-DATABASE_URL=postgresql://postgres:<password>@postgres:5432/<app_name>_db
+DATABASE_URL=postgresql://<app_name>_user:<app_password>@postgres:5432/<app_name>_db
 REDIS_URL=redis://redis:6379
 S3_ENDPOINT=http://minio:9000
 S3_BUCKET=<app_name>-uploads
-S3_ACCESS_KEY=<minio_root_user>
-S3_SECRET_KEY=<minio_root_password>
+S3_ACCESS_KEY=<app-name>-user
+S3_SECRET_KEY=<app_s3_password>