secret

.github/workflows/cd.yml

@@ -184,6 +184,7 @@ jobs:
             LETSENCRYPT_EMAIL=${{ env.LETSENCRYPT_EMAIL }}
             IMAGE_REF=${{ env.IMG }}
             DOCKERHUB_USERNAME=${{ secrets.DOCKERHUB_USERNAME }}
+            PUSH_TOKEN=${{ secrets.PUSH_TOKEN }}
             EOT
           EOF
 

.github/workflows/flask_ci.yml

@@ -15,6 +15,8 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Build & start services
+        env:
+          PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
         run: |
           docker compose up -d --build
           # give the app a moment to start
@@ -26,4 +28,4 @@ jobs:
 
       - name: Tear down
         if: always()
-        run: docker compose down --volumes --remove-orphans
+        run: docker compose down --volumes --remove-orphans

app.py

@@ -17,7 +17,9 @@
 app = Flask(__name__)
 
 DB_PATH = "candles.db"
-PUSH_TOKEN = "여기에_긴랜덤토큰_32자이상"
+PUSH_TOKEN = os.environ.get("PUSH_TOKEN")
+if not PUSH_TOKEN:
+    raise RuntimeError("PUSH_TOKEN not set")
 
 def init_db():
     conn = sqlite3.connect(DB_PATH)

docker-compose.prod.yml

@@ -5,6 +5,7 @@ services:
     image: ${IMAGE_REF}
     environment: # <- 매핑 형식
       FLASK_ENV: production
+      PUSH_TOKEN: ${PUSH_TOKEN}
     expose:
       - "5000"
     restart: unless-stopped

docker-compose.yml

@@ -3,8 +3,9 @@ services:
     build: .
     ports: 
       - 5000:5000
-    environment: 
-      - FLASK_ENV=development
+    environment:
+      FLASK_ENV: development
+      PUSH_TOKEN: ${PUSH_TOKEN:-ci_dummy_token}
 
   nginx:
     image: nginx:alpine
@@ -13,4 +14,4 @@ services:
     depends_on:
       - web
     volumes:
-      - ./nginx:/etc/nginx/conf.d:ro
+      - ./nginx:/etc/nginx/conf.d:ro