Legendary Arena Lab

Secrets and Env

wiki

Secrets and Env

Migration in progress. api.legendary-arena.com and its PostgreSQL are moving off Render onto a self-hosted DigitalOcean Ubuntu droplet fronted by Cloudflare, per docs/PLAN.md . Until decommission, Render stays warm as the rollback target.

Summary

This page describes the environment contract for the la-server application: the full set of variables the process expects at runtime. The owning artifact infra/.env.example holds placeholders only; the real values live in a mode-600 file at /etc/la/.env on the droplet and are never committed.

Mechanics

The owning artifact is infra/.env.example . It is the canonical list of variables the app reads; every entry is a REPLACE_ME (or REPLACE_PASSWORD) placeholder. Operators copy it to /etc/la/.env and fill in real values there. Grouped by concern:

  1. Core — NODE_ENV=production, PORT=3000, API_BASE_URL=https://api.legendary-arena.com. These pin the runtime mode, listen port, and the public API origin.
  2. Database — DATABASE_URL=postgres://la:REPLACE_PASSWORD@localhost:5432/la. The host is localhost, reflecting a co-located PostgreSQL on the same box, not a remote managed instance.
  3. Auth — JWT_SECRET plus the three Hanko variables HANKO_API_URL, HANKO_PROJECT_ID, HANKO_API_KEY.
  4. Stripe — STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_ID.
  5. Analytics / anti-abuse — ANALYTICS_SALT plus four submit tokens: SUBMIT_TOKEN_PRIMARY, SUBMIT_TOKEN_SECONDARY, SUBMIT_TOKEN_TERTIARY, SUBMIT_TOKEN_QUATERNARY.
  6. R2 — R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET.
  7. Brevo alerts — BREVO_API_KEY, BREVO_FROM_EMAIL.

The header comment states the contract directly:

# Copy to /etc/la/.env with mode 600. Never commit real values.

On the lab these may be test-mode values; on the production box they are the real sync:false secrets — roughly fifteen of them — that previously lived in render.yaml and move to /etc/la/.env during the migration, per docs/PLAN.md .

Interactions

  • Deploy Server — provisions the box and installs the systemd unit whose EnvironmentFile=/etc/la/.env consumes exactly these variables.
  • PostgreSQL Setup — owns the database that DATABASE_URL addresses at localhost:5432.
  • Systemd Service — the la-server unit loads this file at process start; a missing or malformed file fails the service.
  • infra/.env.example — the committed placeholder template that defines the contract.

Edge Cases

  • The /etc/la/.env file must be mode 600 and owned appropriately; if it is world-readable, secrets are exposed, and if systemd cannot read it the EnvironmentFile load fails and the service will not start.
  • Never commit real values — only infra/.env.example with REPLACE_ME placeholders belongs in git.
  • DATABASE_URL points at localhost; any assumption of a remote managed database is wrong and will break connectivity.
  • The /etc/la directory is created by cloud-init during provisioning; if that step did not run, the copy target does not exist.

References