nike/.claude/rules/config-deploy.md

description, paths

description	paths
os.getenv + dotenv config, NIKE_ prefix, systemd + docker, fresh-env build order	nike/config.py .env* nike.service Dockerfile docker-compose.yml run.py scripts/**

Config & deployment

• Config is os.getenv + python-dotenv, NOT pydantic-settings. config.py loads .env from the repo root (path-anchored, so it works regardless of CWD) and reads NIKE_* vars into module constants. A new setting = a new os.getenv("NIKE_...", default) plus a line in .env.example. Do not add a Settings model.

• Every env var uses the NIKE_ prefix (red_panda_standards.md). DB config is individual parts (NIKE_DB_HOST/PORT/USER/PASSWORD/NAME) — never a single DATABASE_URL. SERVER_HOST/SERVER_PORT have no default and will raise if unset (deliberate — a missing port should fail loudly, not bind somewhere random).

• .env is gitignored; only .env.example is tracked. Never commit real secrets. Keep .env.example in sync with the NIKE_* vars config.py reads.

• NIKE_TRUSTED_PROXY gates X-Forwarded-* trust. '*' is safe only because Nike's port is firewalled to HAProxy; keep that constraint in mind if the topology changes.

• Fresh-environment build order: pip install -e . → scripts/apply_schema.py (provision the PG cache from schema.sql) → cd dashboard && npm install && npm run build → python run.py. The dashboard build is a hard prerequisite for serving /. Any change to this flow must keep the fresh path working.

• Deploy is systemd (nike.service) with a Docker option (Dockerfile + docker-compose.yml). Note the checked-in nike.service has a stale WorkingDirectory/ExecStart (/home/robert/gitea/nike) — flag it if you touch the unit; the repo lives at ~/git/nike. Per the estate venv convention the runtime venv is ~/env/nike.

• run.py is the entry point (python run.py → nike.server:main → uvicorn). Keep it a thin shim.