deploy: collapse to single .env, make updater token optional for main app

[rg4444]

deploy: collapse to single .env file, make updater token optional for main app

UX cleanup. Same architecture (separate updater sidecar) but installs as cleanly as a single-binary product.

Two surgical changes, both addressing the friction noted in #130 (comment)... — sorry, addressing operator feedback: "two .env files is confusing" and "I shouldn't have to generate a 64-char hex string just to start the app."

Change 1 — Single .env file

Before

File	Used for
../.env (project root)	App config; passed via env_file:
deploy/.env	Interpolation source for token + version

After

File	Used for
deploy/.env	Everything — single source of truth

Compose automatically reads deploy/.env for variable substitution because it lives next to the compose file. The same file is now also the env_file: source for the main app and bootstrap services. The updater's RW bind mount of deploy/ already exposes it at /deploy/.env, so the in-place rewrite on commit works unchanged.

Side benefit: the ..:/host-root:ro bind mount on the updater container is gone — it only existed to reach ../.env. One fewer bind mount, narrower attack surface.

Change 2 — Token is optional for the main app

Before — compose up fails immediately if PROCESSGIT_UPDATER_TOKEN is unset, even on operators who don't want self-updates.

After

Service	Token policy
processgit (main app)	${PROCESSGIT_UPDATER_TOKEN:-} — optional
processgit-updater	${PROCESSGIT_UPDATER_TOKEN:?…} — required (with actionable error)

Effect

• Operators who want the full deployment (default): set the token once in deploy/.env, run docker compose up -d. Identical to before.
• Operators who don't want self-updates (change-controlled gov/PwC deployments, etc.): leave the token blank, run docker compose up -d processgit-init-perms processgit processgit-bootstrap. The main app starts identically; no friction.

The updater service's required-token error now spells out both paths:

... requires PROCESSGIT_UPDATER_TOKEN in deploy/.env. Generate one with openssl rand -hex 32 and add it. Or omit this service from docker compose up if you don't want self-updates.

Resulting install UX

git clone --branch v0.1.0 https://github.com/Algomation-AI/ProcessGit.git
cd ProcessGit
cp deploy/.env.example deploy/.env
# Optional but recommended — enables the in-product self-update story:
echo "PROCESSGIT_UPDATER_TOKEN=$(openssl rand -hex 32)" >> deploy/.env
docker compose -f deploy/docker-compose.yml up -d

Three to four commands, one .env file. Updater on by default; opt-out is a flag on up.

.env.example rewrite

Reformatted as a clean single-source-of-truth template:

• Token + version + repo + stub flag (the updater section, clearly required-vs-optional)
• App-config keys operators commonly need (DOMAIN, ROOT_URL, APP_NAME, DISABLE_REGISTRATION) with examples — these were previously buried in ../.env which we no longer use
• Explicit "Opting out of self-updates" section with the exact compose up command

Validation

• YAML syntax valid (python3 yaml.safe_load)
• Programmatic assertions:
  • env_file: ['.env'] on processgit + bootstrap (not ../.env)
  • Optional ${...:-} on processgit's TOKEN
  • Required ${...:?...} on processgit-updater's TOKEN
  • No host-root mount remaining on the updater
• No structural changes to services, networks, ports, volumes, healthchecks, or dependency ordering

Diff stat

 deploy/.env.example       | 107 +++++++++++++++++++++++++--------------------
 deploy/docker-compose.yml |  48 ++++++++++++---------
 2 files changed, 88 insertions(+), 67 deletions(-)

Sequencing

The README rewrite (PR-2 in this cleanup pass) is its own follow-up because the install instructions there reference the new flow. Best merged before or with this one.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3ed9fa4097

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove required token interpolation from optional service

Using ${PROCESSGIT_UPDATER_TOKEN:?...} here breaks the advertised “run without updater” flow, because Compose resolves variable interpolation across the Compose model before service selection; a missing required variable aborts parsing even when up targets only processgit-init-perms processgit processgit-bootstrap. In practice, docker compose -f deploy/docker-compose.yml up -d processgit-init-perms processgit processgit-bootstrap will still fail unless a token is set, so the new optional-token behavior for the main app is not actually reachable.

Useful? React with 👍 / 👎.