From 6e9726f28e6f026a5ffebc3e5de1a2e34d552cd4 Mon Sep 17 00:00:00 2001
From: Kunthawat Greethong <kunthawat@Kunthawats-MacBook-Pro.local>
Date: Mon, 15 Jun 2026 22:32:43 +0700
Subject: [PATCH] fix: bake SCANNER_SERVICE_URL into the combined image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bake SCANNER_SERVICE_URL=http://127.0.0.1:8001 and PYTHONUNBUFFERED=1
into /etc/profile.d/consentos.sh inside the image and source that file
from /entrypoint.sh so every supervisord child (api, worker, beat,
scanner) inherits the same defaults — both for EasyPanel deploys and
local docker compose.

Drop the inline env injection in supervisord.conf since the entrypoint
now sets it. Single source of truth: the Dockerfile.
---
 Dockerfile       | 8 ++++++++
 entrypoint.sh    | 7 +++++++
 supervisord.conf | 8 ++------
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index bd316cf..4b42f12 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -64,6 +64,14 @@ COPY supervisord.conf /etc/supervisord.conf
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
+# Bake defaults that worker/beat/scanner need at runtime into the image
+# so EasyPanel deploys and local docker compose behave the same. Values
+# can still be overridden at deploy time with environment variables.
+RUN { \
+        echo 'SCANNER_SERVICE_URL=http://127.0.0.1:8001'; \
+        echo 'PYTHONUNBUFFERED=1'; \
+    } > /etc/profile.d/consentos.sh
+
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD curl -f http://localhost/health || exit 1
 
diff --git a/entrypoint.sh b/entrypoint.sh
index 1c62463..4eeee88 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,6 +1,13 @@
 #!/bin/sh
 set -e
 
+# Source runtime defaults baked into the image so supervisord's children
+# (api, worker, beat, scanner) inherit them. Variables already set in the
+# environment take precedence — easy panel / docker compose overrides win.
+for f in /etc/profile.d/*.sh; do
+    [ -r "$f" ] && . "$f"
+done
+
 # Extract host and port from DATABASE_URL
 DB_HOST=$(echo "$DATABASE_URL" | sed -E 's|.*@([^/:]+).*|\1|')
 DB_PORT=$(echo "$DATABASE_URL" | sed -E 's|.*@[^/:]+:([0-9]+)/.*|\1|')
diff --git a/supervisord.conf b/supervisord.conf
index db33454..c7cf3d4 100644
--- a/supervisord.conf
+++ b/supervisord.conf
@@ -28,10 +28,9 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=200
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:worker]
-command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app worker --loglevel=info --concurrency=2"
+command=celery -A src.celery_app worker --loglevel=info --concurrency=2
 directory=/app
 autostart=true
 autorestart=true
@@ -42,10 +41,9 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=30
 killasgroup=true
 priority=300
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:beat]
-command=sh -c "SCANNER_SERVICE_URL=http://127.0.0.1:8001 celery -A src.celery_app beat --loglevel=info"
+command=celery -A src.celery_app beat --loglevel=info
 directory=/app
 autostart=true
 autorestart=true
@@ -56,7 +54,6 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=400
-environment=PYTHONUNBUFFERED="1",SCANNER_SERVICE_URL="http://127.0.0.1:8001"
 
 [program:scanner]
 command=python -m src.worker
@@ -71,4 +68,3 @@ stderr_logfile_maxbytes=0
 stopwaitsecs=10
 killasgroup=true
 priority=150
-environment=PYTHONUNBUFFERED="1"