refactor(config): repository URL is env-driven (no private URL in tracked files)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -85,6 +85,10 @@ ACME_EMAIL=
 # .git (the prod image ships none) — leave empty; in dev the page reads .git directly.
 CLUSEV_BUILD_SHA=
 CLUSEV_BUILD_BRANCH=
+# Update source for the in-app version check. install.sh derives this from the clone origin
+# (git remote get-url origin). Leave empty to disable the check. Never put a private repo URL in a
+# tracked file — only here in the per-deployment .env.
+CLUSEV_REPOSITORY=
 # Display timezone for dashboard times (DB stays UTC). install.sh sets this from the host; UTC default.
 APP_TIMEZONE=UTC
 # External reverse-proxy TLS: set to the upstream proxy's address/CIDR so Caddy trusts its

config/clusev.php

@@ -19,8 +19,10 @@ return [
     // is the fallback so a domain set during install still gets automatic TLS.
     'domain' => env('APP_DOMAIN'),
 
-    // Real project home (self-hosted Gitea) + license. Open-core, AGPL.
-    'repository' => 'https://git.bave.dev/boban/clusev',
+    // Update source. Empty by default: the PUBLIC repo URL is injected via CLUSEV_REPOSITORY (env),
+    // which install.sh derives from the clone origin. Private (Gitea/GitHub-private) URLs live ONLY in
+    // the gitignored .env — never in tracked files, so the public repo exposes no private URL.
+    'repository' => env('CLUSEV_REPOSITORY', ''),
 
     'license' => 'AGPL-3.0',
 ];

tests/Feature/ReleaseCheckerTest.php

@@ -88,4 +88,16 @@ class ReleaseCheckerTest extends TestCase
         Cache::put('clusev:latest-release:stable', '0.9.11', now()->addMinutes(30));
         $this->get('/audit')->assertOk()->assertSee(__('shell.update_available'));
     }
+
+    public function test_no_update_check_when_no_repository_is_configured(): void
+    {
+        Http::fake(); // any network call would be a bug
+        config()->set('clusev.repository', '');
+        config()->set('clusev.version', '0.9.10');
+        Cache::flush();
+
+        $this->assertFalse(app(ReleaseChecker::class)->updateAvailable());
+        $this->assertNull(app(ReleaseChecker::class)->refresh('stable'));
+        Http::assertNothingSent();
+    }
 }