---
description: os.getenv + dotenv config, NIKE_ prefix, systemd + docker, fresh-env build order
paths:
  - "nike/config.py"
  - ".env*"
  - "nike.service"
  - "Dockerfile"
  - "docker-compose.yml"
  - "run.py"
  - "scripts/**"
---

# Config & deployment

- **Config is `os.getenv` + `python-dotenv`, NOT pydantic-settings.** `config.py`
  loads `.env` from the repo root (path-anchored, so it works regardless of CWD) and
  reads `NIKE_*` vars into module constants. A new setting = a new
  `os.getenv("NIKE_...", default)` **plus** a line in `.env.example`. Do not add a
  `Settings` model.

- **Every env var uses the `NIKE_` prefix** (`red_panda_standards.md`). DB config is
  **individual parts** (`NIKE_DB_HOST/PORT/USER/PASSWORD/NAME`) — never a single
  `DATABASE_URL`. `SERVER_HOST`/`SERVER_PORT` have no default and will raise if
  unset (deliberate — a missing port should fail loudly, not bind somewhere random).

- **`.env` is gitignored; only `.env.example` is tracked.** Never commit real
  secrets. Keep `.env.example` in sync with the `NIKE_*` vars `config.py` reads.

- **`NIKE_TRUSTED_PROXY` gates `X-Forwarded-*` trust.** `'*'` is safe only because
  Nike's port is firewalled to HAProxy; keep that constraint in mind if the topology
  changes.

- **Fresh-environment build order:** `pip install -e .` → `scripts/apply_schema.py`
  (provision the PG cache from `schema.sql`) → `cd dashboard && npm install && npm
  run build` → `python run.py`. The dashboard build is a hard prerequisite for
  serving `/`. Any change to this flow must keep the fresh path working.

- **Deploy is systemd (`nike.service`) with a Docker option** (`Dockerfile` +
  `docker-compose.yml`). Note the checked-in `nike.service` has a **stale
  `WorkingDirectory`/`ExecStart`** (`/home/robert/gitea/nike`) — flag it if you
  touch the unit; the repo lives at `~/git/nike`. Per the estate venv convention the
  runtime venv is `~/env/nike`.

- **`run.py` is the entry point** (`python run.py` → `nike.server:main` → uvicorn).
  Keep it a thin shim.