Developer
67e432564d
Build & Deploy (Nix) / build-and-deploy (backend) (push) Successful in 1m34s
Build & Deploy (Nix) / build-and-deploy (discord-gateway) (push) Successful in 2m22s
Build & Deploy (Nix) / build-and-deploy (proxy) (push) Successful in 2m37s
Previously /etc/gmw/*.env was managed by hand on the VPS; AI_LLM_* and other vars drifted silently (AI_LLM_EMBEDDING_MODEL was missing until added manually today). Now: - BACKEND_ENV / GATEWAY_ENV secrets hold the full env block per service - deploy.yml streams the secret to the VPS via stdin before the deploy (never through argv — no shell escaping issues, no secret exposure) - env file chown'd gmw:gmw, chmod 600; empty secret = skip (no clobber) - .env.example documents the declarative workflow Update production env = edit the Gitea secret + push, never SSH by hand.