delonet-dotenv

Choose-your-own-adventure for filling env vars on Jarad's big-chungus server. The body is a routing surface — every section ends with "for X, read references/Y.md". Stop reading the moment your decision is made.

Operating principles

• Two-file split. Non-secrets go in .env. Secrets go in .env.op as op://DeLoSecrets/<Item>/<field> references; resolve at run time with op run --env-file .env.op -- docker compose up. Never paste raw secrets into .env.
• delo.sh by default. Public hostname = <service>.delo.sh. API subdomain = api.<service>.delo.sh. Cloudflare Tunnel routes both into Traefik — no port-forward, no public IP, no certs to manage.
• Cloudflare wins ties. Resend exists as SMTP fallback, but for DNS, Turnstile, R2, email routing, etc., Cloudflare beats every alternative.
• Container-to-container by service name (e.g. postgres, redis). LAN IPs in env files are stale and must be replaced (see gotchas.md).
• Port assumption is bug. Big-chungus is busy. If the stack must bind a host port, pick something in 13000-25000. Better: skip the host bind and let Traefik route via the proxy network.

Routing table