From a1386b05331c47a03601f95174920f87d60a7ee4 Mon Sep 17 00:00:00 2001 From: boban Date: Mon, 22 Jun 2026 20:35:59 +0200 Subject: [PATCH] refactor(config): repository URL is env-driven (no private URL in tracked files) Co-Authored-By: Claude Opus 4.8 --- .env.example | 4 ++++ config/clusev.php | 6 ++++-- tests/Feature/ReleaseCheckerTest.php | 12 ++++++++++++ 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/.env.example b/.env.example index 6ddfe82..0940896 100644 --- a/.env.example +++ b/.env.example @@ -85,6 +85,10 @@ ACME_EMAIL= # .git (the prod image ships none) — leave empty; in dev the page reads .git directly. CLUSEV_BUILD_SHA= CLUSEV_BUILD_BRANCH= +# Update source for the in-app version check. install.sh derives this from the clone origin +# (git remote get-url origin). Leave empty to disable the check. Never put a private repo URL in a +# tracked file — only here in the per-deployment .env. +CLUSEV_REPOSITORY= # Display timezone for dashboard times (DB stays UTC). install.sh sets this from the host; UTC default. APP_TIMEZONE=UTC # External reverse-proxy TLS: set to the upstream proxy's address/CIDR so Caddy trusts its diff --git a/config/clusev.php b/config/clusev.php index 97432f3..4d05f98 100644 --- a/config/clusev.php +++ b/config/clusev.php @@ -19,8 +19,10 @@ return [ // is the fallback so a domain set during install still gets automatic TLS. 'domain' => env('APP_DOMAIN'), - // Real project home (self-hosted Gitea) + license. Open-core, AGPL. - 'repository' => 'https://git.bave.dev/boban/clusev', + // Update source. Empty by default: the PUBLIC repo URL is injected via CLUSEV_REPOSITORY (env), + // which install.sh derives from the clone origin. Private (Gitea/GitHub-private) URLs live ONLY in + // the gitignored .env — never in tracked files, so the public repo exposes no private URL. + 'repository' => env('CLUSEV_REPOSITORY', ''), 'license' => 'AGPL-3.0', ]; diff --git a/tests/Feature/ReleaseCheckerTest.php b/tests/Feature/ReleaseCheckerTest.php index 608b3d6..e451134 100644 --- a/tests/Feature/ReleaseCheckerTest.php +++ b/tests/Feature/ReleaseCheckerTest.php @@ -88,4 +88,16 @@ class ReleaseCheckerTest extends TestCase Cache::put('clusev:latest-release:stable', '0.9.11', now()->addMinutes(30)); $this->get('/audit')->assertOk()->assertSee(__('shell.update_available')); } + + public function test_no_update_check_when_no_repository_is_configured(): void + { + Http::fake(); // any network call would be a bug + config()->set('clusev.repository', ''); + config()->set('clusev.version', '0.9.10'); + Cache::flush(); + + $this->assertFalse(app(ReleaseChecker::class)->updateAvailable()); + $this->assertNull(app(ReleaseChecker::class)->refresh('stable')); + Http::assertNothingSent(); + } }