Nicolas
266f540d88
Found on http://batch.dev.kyuno.fr/: login/signup succeeded (200/201, profile in the body) but every subsequent request 401'd. Cause: the session cookie is `secure: NODE_ENV === "production"`, and docker-compose.yml sets NODE_ENV=production regardless of whether the deployment actually has TLS in front of it. A Secure cookie is silently never sent back by the browser over plain HTTP — no error, just a cookie that never round-trips. Adds COOKIE_SECURE, independent from NODE_ENV, to override the flag per deployment. Unset (default) keeps prior behavior — secure in production. Set COOKIE_SECURE=false only for a deployment reachable over plain HTTP (no TLS yet), like this dev instance. Verified locally: docker compose up with COOKIE_SECURE=false persists and round-trips the cookie (signup -> /auth/me 200); without it, the cookie still gets Secure as before. Full pnpm --filter api test / test:bdd suites still pass (66 + 25 scenarios). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
restart: unless-stopped
|
|
environment:
|
|
# No defaults on purpose: POSTGRES_USER/PASSWORD/DB must be set in your
|
|
# local, git-ignored .env (see .env.example). Compose fails loudly if
|
|
# they're missing instead of falling back to a guessable credential.
|
|
POSTGRES_USER: ${POSTGRES_USER:?set POSTGRES_USER in .env}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
|
|
POSTGRES_DB: ${POSTGRES_DB:?set POSTGRES_DB in .env}
|
|
ports:
|
|
- "${POSTGRES_PORT:-5432}:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# Single service serving both the API and the built frontend (see
|
|
# apps/api/Dockerfile) — no separate nginx/web container, no cross-origin
|
|
# CORS_ORIGIN to keep in sync between two ports.
|
|
app:
|
|
build:
|
|
context: .
|
|
dockerfile: apps/api/Dockerfile
|
|
restart: unless-stopped
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
NODE_ENV: production
|
|
PORT: 3000
|
|
# Uses the "postgres" service name, not localhost/POSTGRES_PORT —
|
|
# container-to-container traffic stays on the compose network and
|
|
# always targets Postgres's internal port (5432).
|
|
DATABASE_URL: "postgresql://${POSTGRES_USER:?set POSTGRES_USER in .env}:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:?set POSTGRES_DB in .env}?schema=public"
|
|
JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
|
|
# Unset by default (falls back to NODE_ENV === "production", i.e.
|
|
# Secure cookie required) — set COOKIE_SECURE=false in .env only if
|
|
# this deployment is reachable over plain HTTP (no TLS in front of
|
|
# it yet), otherwise the session cookie never comes back and every
|
|
# authenticated request 401s despite login succeeding. See its doc
|
|
# comment in apps/api/src/config/env.ts.
|
|
COOKIE_SECURE: ${COOKIE_SECURE:-}
|
|
ports:
|
|
- "${APP_PORT:-3000}:3000"
|
|
|
|
volumes:
|
|
postgres_data:
|