fix: bake SCANNER_SERVICE_URL into the combined image

Bake SCANNER_SERVICE_URL=http://127.0.0.1:8001 and PYTHONUNBUFFERED=1
into /etc/profile.d/consentos.sh inside the image and source that file
from /entrypoint.sh so every supervisord child (api, worker, beat,
scanner) inherits the same defaults — both for EasyPanel deploys and
local docker compose.

Drop the inline env injection in supervisord.conf since the entrypoint
now sets it. Single source of truth: the Dockerfile.

Dockerfile

@@ -64,6 +64,14 @@ COPY supervisord.conf /etc/supervisord.conf
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
+# Bake defaults that worker/beat/scanner need at runtime into the image
+# so EasyPanel deploys and local docker compose behave the same. Values
+# can still be overridden at deploy time with environment variables.
+RUN { \
+        echo 'SCANNER_SERVICE_URL=http://127.0.0.1:8001'; \
+        echo 'PYTHONUNBUFFERED=1'; \
+    } > /etc/profile.d/consentos.sh
+
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD curl -f http://localhost/health || exit 1
 

entrypoint.sh

@@ -1,6 +1,13 @@
 #!/bin/sh
 set -e
 
+# Source runtime defaults baked into the image so supervisord's children
+# (api, worker, beat, scanner) inherit them. Variables already set in the
+# environment take precedence — easy panel / docker compose overrides win.
+for f in /etc/profile.d/*.sh; do
+    [ -r "$f" ] && . "$f"
+done
+
 # Extract host and port from DATABASE_URL
 DB_HOST=$(echo "$DATABASE_URL" | sed -E 's|.*@([^/:]+).*|\1|')
 DB_PORT=$(echo "$DATABASE_URL" | sed -E 's|.*@[^/:]+:([0-9]+)/.*|\1|')

supervisord.conf

@@ -28,10 +28,9 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=200
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:worker]
-command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app worker --loglevel=info --concurrency=2"
+command=celery -A src.celery_app worker --loglevel=info --concurrency=2
 directory=/app
 autostart=true
 autorestart=true
@@ -42,10 +41,9 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=30
 killasgroup=true
 priority=300
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:beat]
-command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app beat --loglevel=info"
+command=celery -A src.celery_app beat --loglevel=info
 directory=/app
 autostart=true
 autorestart=true
@@ -56,7 +54,6 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=400
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:scanner]
 command=python -m src.worker
@@ -71,4 +68,3 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=150
-environment=PYTHONUNBUFFERED="1"