backup

Makefile

@@ -37,37 +37,57 @@ DEV_IMAGES := \
 COMPOSE := $(shell command -v podman-compose 2>/dev/null \
              || echo "podman compose")
 
+# Env file in the project root.
+# Passed explicitly because docker compose v2 defaults to the compose file's
+# directory as the project directory, not the shell's cwd.
+ENV_FILE := .env
+COMPOSE_OPTS := --env-file $(ENV_FILE) -f $(COMPOSE_FILE)
+
 # Detect available container runtime (podman or docker).
 RUNTIME := $(shell command -v podman 2>/dev/null || echo "docker")
 
-.PHONY: up down build restart logs clean dev-ban-test e2e
+.PHONY: up down build restart logs clean dev-ban-test e2e ensure-env
+
+## Ensure .env exists with BANGUI_SESSION_SECRET set.
+## Copies .env.example → .env on first run and auto-generates the secret.
+ensure-env:
+	@if [ ! -f .env ]; then \
+	  cp .env.example .env; \
+	  python3 -c "\
+import re, secrets; \
+content = open('.env').read(); \
+secret = secrets.token_hex(32); \
+content = re.sub(r'(?m)^BANGUI_SESSION_SECRET=.*', 'BANGUI_SESSION_SECRET=' + secret, content); \
+open('.env', 'w').write(content); \
+print('Created .env with a generated BANGUI_SESSION_SECRET.')"; \
+	fi
 
 ## Start the debug stack (detached).
 ## Ensures log stub files exist so fail2ban can open them on first start.
-up:
+up: ensure-env
 	@mkdir -p Docker/logs
 	@touch Docker/logs/auth.log
-	$(COMPOSE) -f $(COMPOSE_FILE) up -d
+	$(COMPOSE) $(COMPOSE_OPTS) up -d
 
 ## Stop the debug stack.
-down:
-	$(COMPOSE) -f $(COMPOSE_FILE) down
+down: ensure-env
+	$(COMPOSE) $(COMPOSE_OPTS) down
 
 ## (Re)build the backend image without starting containers.
-build:
-	$(COMPOSE) -f $(COMPOSE_FILE) build
+build: ensure-env
+	$(COMPOSE) $(COMPOSE_OPTS) build
 
 ## Restart the debug stack.
 restart: down up
 
 ## Tail logs for all debug services.
-logs:
-	$(COMPOSE) -f $(COMPOSE_FILE) logs -f
+logs: ensure-env
+	$(COMPOSE) $(COMPOSE_OPTS) logs -f
 
 ## Stop containers, remove ALL debug volumes and locally-built images.
 ## The next 'make up' will rebuild images from scratch and start fresh.
-clean:
-	$(COMPOSE) -f $(COMPOSE_FILE) down --remove-orphans
+clean: ensure-env
+	$(COMPOSE) $(COMPOSE_OPTS) down --remove-orphans
 	$(RUNTIME) volume rm $(DEV_VOLUMES) 2>/dev/null || true
 	$(RUNTIME) rmi $(DEV_IMAGES) 2>/dev/null || true
 	@echo "All debug volumes and local images removed. Run 'make up' to rebuild and start fresh."
@@ -88,8 +108,8 @@ e2e: up
 
 ## One-command smoke test for the ban pipeline:
 ##   1. Start fail2ban, 2. write failure lines, 3. check ban status.
-dev-ban-test:
-	$(COMPOSE) -f $(COMPOSE_FILE) up -d fail2ban
+dev-ban-test: ensure-env
+	$(COMPOSE) $(COMPOSE_OPTS) up -d fail2ban
 	sleep 5
 	bash Docker/simulate_failed_logins.sh
 	sleep 3