update env vars

CLAUDE.md

@@ -75,7 +75,7 @@ Strong success criteria let you loop independently. Weak criteria ("make it work
 - `server/core/` — Go API server (`oxynote-core`). Go module `github.com/oxynote/oxynote/server/core`. Details: [server/CLAUDE.md](server/CLAUDE.md).
 - `server/auth-realtime/` — Node service (`@oxynote/auth-realtime`, **pnpm**) running Better Auth and a Hocuspocus (Yjs) server in one Hono process. Details: [server/CLAUDE.md](server/CLAUDE.md).
 - `datagen/` — demo-data generator; separate Go module `github.com/oxynote/oxynote/datagen`. Demo/testing only.
-- `docker/` — dev docker-compose stack, Caddyfile, `env/` (committed `*.example.env` templates; `make setup` copies them to gitignored `*.local.env`, which is what the compose stack reads), `demo/` (demo-data configs for mariadb/postgres/prometheus).
+- `docker/` — dev docker-compose stack, Caddyfile, `env/` (committed `*.example.env` templates; `make setup` copies them to the gitignored `*.local.env` files the compose stack reads, and `web.example.env` also to `web/.env` for the host dev server and electron builds), `demo/` (demo-data configs for mariadb/postgres/prometheus).
 
 ## Common commands
 

Makefile

@@ -17,7 +17,7 @@ start: build-go
 # stops the web dev server; `make stop` stops the containers.
 dev: build-go
 	$(COMPOSE) up --build -d
-	cd web && pnpm run start:dev:web
+	cd web && NUXT_PUBLIC_APP_BASE_URL=http://localhost:3000 pnpm run start:dev:web
 
 stop:
 	$(COMPOSE) --profile web down
@@ -30,6 +30,7 @@ setup:
 	for f in core auth-realtime web; do \
 		test -f docker/env/$$f.local.env || cp docker/env/$$f.example.env docker/env/$$f.local.env; \
 	done
+	test -f web/.env || cp docker/env/web.example.env web/.env
 
 deps:
 	cd web && pnpm run deps

docker/docker-compose.dev.yaml

@@ -20,6 +20,12 @@ services:
   web:
     container_name: web
     image: ghcr.io/oxynote/web:dev
+    environment:
+      # SSR inside the container must reach the services directly; these
+      # compose hostnames don't resolve on the host, which is why they live
+      # here and not in the shared env template.
+      - NUXT_CORE_API_INTERNAL_HTTP_URL=http://core:8080
+      - NUXT_AUTH_REALTIME_API_INTERNAL_HTTP_URL=http://auth-realtime:8081
     # not started by plain `up` — `make dev` runs web on the host instead;
     # `make run` / `make start` enable this profile for the full stack.
     profiles:

docker/env/web.example.env

@@ -1,7 +1,9 @@
-# every runtime-config variable the web app reads is listed here
-# explicitly, even when empty. `make setup` copies this template to
-# web.local.env (gitignored) when missing; the dev compose reads only the
-# .local.env file. The node-server build reads these at container start.
+# the single env template for the web app. `make setup` copies it to both
+# web.local.env (read by the web container at start) and web/.env (auto-
+# loaded by the host `nuxt dev` server and the electron builds). Every
+# runtime-config variable the web app reads is listed explicitly, even when
+# empty. `make dev` overrides NUXT_PUBLIC_APP_BASE_URL to the dev server's
+# :3000 origin.
 
 # public URLs (what the browser uses — the caddy front door)
 NUXT_PUBLIC_APP_BASE_URL=http://localhost:8080
@@ -10,10 +12,6 @@ NUXT_PUBLIC_AUTH_REALTIME_API_BASE_WS_URL=ws://localhost:8080/auth-realtime/hocu
 NUXT_PUBLIC_CORE_API_BASE_HTTP_URL=http://localhost:8080/core
 NUXT_PUBLIC_CORE_API_BASE_WS_URL=ws://localhost:8080/core
 
-# server-only URLs (what SSR inside the container uses — service hostnames)
-NUXT_CORE_API_INTERNAL_HTTP_URL=http://core:8080
-NUXT_AUTH_REALTIME_API_INTERNAL_HTTP_URL=http://auth-realtime:8081
-
 # optional
 NUXT_PUBLIC_SENTRY_DSN=
 NUXT_PUBLIC_LINK_TO_MORE_INFO_ABOUT_PRODUCT=https://oxynote.io
@@ -29,3 +27,7 @@ NUXT_PUBLIC_PROMETHEUS_QUERY_GUIDE_URL=https://prometheus.io/docs/prometheus/lat
 NUXT_PUBLIC_POSTGRESQL_QUERY_GUIDE_URL=https://www.postgresql.org/docs/current/sql-select.html
 NUXT_PUBLIC_MYSQL_QUERY_GUIDE_URL=https://dev.mysql.com/doc/refman/8.0/en/select.html
 NUXT_PUBLIC_MARIADB_QUERY_GUIDE_URL=https://mariadb.com/kb/en/select/
+
+# build-time secret for the Sentry build plugin (source map upload); not
+# runtime config.
+SENTRY_AUTH_TOKEN=

web/.env.example

@@ -1,22 +0,0 @@
-NUXT_PUBLIC_SENTRY_DSN=
-NUXT_PUBLIC_APP_BASE_URL=http://localhost:3000
-NUXT_PUBLIC_LINK_TO_MORE_INFO_ABOUT_PRODUCT=https://oxynote.io
-NUXT_PUBLIC_AUTH_REALTIME_API_BASE_HTTP_URL=http://localhost:8080/auth-realtime
-NUXT_PUBLIC_AUTH_REALTIME_API_BASE_WS_URL=ws://localhost:8080/auth-realtime/hocuspocus
-NUXT_PUBLIC_CORE_API_BASE_HTTP_URL=http://localhost:8080/core
-NUXT_PUBLIC_CORE_API_BASE_WS_URL=ws://localhost:8080/core
-NUXT_PUBLIC_TERMS_OF_SERVICE_URL=https://oxynote.io/terms-of-service
-NUXT_PUBLIC_PRIVACY_POLICY_URL=https://oxynote.io/privacy-policy
-NUXT_PUBLIC_EXPERIMENTAL_FEATURES=
-NUXT_PUBLIC_POSTGRESQL_READ_ONLY_USER_SETUP_GUIDE_URL=https://tableplus.com/blog/2018/04/postgresql-how-to-create-read-only-user.html
-NUXT_PUBLIC_MYSQL_READ_ONLY_USER_SETUP_GUIDE_URL=https://guide.trevor.io/hc/en-us/articles/6843804879261-Creating-a-read-only-database-user-in-MySQL
-NUXT_PUBLIC_MARIADB_READ_ONLY_USER_SETUP_GUIDE_URL=https://guide.trevor.io/hc/en-us/articles/6843804879261-Creating-a-read-only-database-user-in-MySQL
-NUXT_PUBLIC_PROMETHEUS_QUERY_GUIDE_URL=https://prometheus.io/docs/prometheus/latest/querying/basics/
-NUXT_PUBLIC_POSTGRESQL_QUERY_GUIDE_URL=https://www.postgresql.org/docs/current/sql-select.html
-NUXT_PUBLIC_MYSQL_QUERY_GUIDE_URL=https://dev.mysql.com/doc/refman/8.0/en/select.html
-NUXT_PUBLIC_MARIADB_QUERY_GUIDE_URL=https://mariadb.com/kb/en/select/
-
-# DO NOT commit this file to your repository!
-# The SENTRY_AUTH_TOKEN variable is picked up by the Sentry Build Plugin.
-# It's used for authentication when uploading source maps.
-SENTRY_AUTH_TOKEN=

web/vite.electron.config.ts

@@ -20,12 +20,12 @@ try {
 
 // Auth env vars are baked into the bundle at build time. Runtime env can't
 // override them — this is the security boundary for the desktop app.
-const apiBaseURL = process.env.NUXT_PUBLIC_NODEJS_API_BASE_HTTP_URL
+const apiBaseURL = process.env.NUXT_PUBLIC_AUTH_REALTIME_API_BASE_HTTP_URL
 const appBaseURL = process.env.NUXT_PUBLIC_APP_BASE_URL
 
 if (!apiBaseURL || !appBaseURL) {
 	throw new Error(
-		"electron build requires NUXT_PUBLIC_NODEJS_API_BASE_HTTP_URL and NUXT_PUBLIC_APP_BASE_URL env vars",
+		"electron build requires NUXT_PUBLIC_AUTH_REALTIME_API_BASE_HTTP_URL and NUXT_PUBLIC_APP_BASE_URL env vars",
 	)
 }