feat: migrate secrets to Infisical

deploy/compose.production.yml

@@ -5,26 +5,29 @@ services:
     image: ${SHD_IMAGE:-shd-build-production:local}
     restart: unless-stopped
     init: true
-    env_file:
-      - .env.production.runtime
     environment:
-      HOST: 0.0.0.0
-      PORT: 3000
-      BODY_SIZE_LIMIT: 6M
-      SKIP_DEFAULT_USERS: 'true'
-      TDR_DATABASE_PATH: /app/data/shd-build-production.db
-      TDR_AVATAR_STORAGE_PATH: /app/data/avatars
-      TDR_GAME_ICON_STORAGE_PATH: /app/data/game-icons
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: prod
+      INFISICAL_RUNTIME_SCOPE: app
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
       SHD_BUILD_NUMBER: ${SHD_BUILD_NUMBER:-0}
-      APP_ORIGIN: https://shd.build
-      ORIGIN: https://shd.build
-      PASSKEY_RP_ID: shd.build
-      DISCORD_REDIRECT_URI: https://shd.build/auth/discord/callback
-      UBISOFT_NEWS_IMPORT_ENABLED: 'true'
+      SHD_COMMIT_SHA: ${SHD_COMMIT_SHA:-}
     ports:
       - '0.0.0.0:${SHD_PRODUCTION_PORT:-3102}:3000'
     volumes:
       - shd_production_data:/app/data
+    secrets:
+      - source: infisical_app_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_app_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
     healthcheck:
       test:
         - CMD
@@ -43,10 +46,23 @@ services:
     init: true
     command:
       - scheduler
-    env_file:
-      - .env.production.runtime
     environment:
-      SCHEDULER_URL: http://app:3000/api/internal/scheduler
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: prod
+      INFISICAL_RUNTIME_SCOPE: scheduler
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
+    secrets:
+      - source: infisical_scheduler_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_scheduler_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
     depends_on:
       app:
         condition: service_healthy
@@ -55,3 +71,13 @@ services:
 volumes:
   shd_production_data:
     name: shd-build-production-data
+
+secrets:
+  infisical_app_client_id:
+    file: .infisical.app.client-id
+  infisical_app_client_secret:
+    file: .infisical.app.client-secret
+  infisical_scheduler_client_id:
+    file: .infisical.scheduler.client-id
+  infisical_scheduler_client_secret:
+    file: .infisical.scheduler.client-secret