From f794dacd2daa0a42e9e89f14416d7e617ca3cbca Mon Sep 17 00:00:00 2001
From: LaurensBartelds <48316768+LaurensBartelds@users.noreply.github.com>
Date: Mon, 27 Apr 2026 01:02:17 +0200
Subject: [PATCH] feat: add JWT_SECRET to deployment and create .env file for
 environment variables

---
 .gitea/workflows/deploy.yml  | 3 ++-
 .gitea/workflows/release.yml | 8 ++++++++
 ansible/deploy.yml           | 6 ++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 4aafd8c..f1f6d30 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -55,7 +55,8 @@ jobs:
         run: |
           ansible-playbook ansible/deploy.yml \
             -i /tmp/inventory.ini \
-            -e "artifact_path=${WORKSPACE}"
+            -e "artifact_path=${WORKSPACE}" \
+            -e "jwt_secret=${{ secrets.JWT_SECRET }}"
 
       - name: Cleanup
         if: always()
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 92abf92..71c5eba 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -63,6 +63,10 @@ jobs:
                 - "3001:3001"
               volumes:
                 - brainwave-db:/app/backend/db
+              env_file:
+                - .env
+              environment:
+                - NODE_ENV=production
               restart: unless-stopped
           volumes:
             brainwave-db:
@@ -77,6 +81,10 @@ jobs:
                 - "3001:3001"
               volumes:
                 - brainwave-db:/app/backend/db
+              env_file:
+                - .env
+              environment:
+                - NODE_ENV=production
               restart: unless-stopped
           volumes:
             brainwave-db:
diff --git a/ansible/deploy.yml b/ansible/deploy.yml
index 492063e..7543c8f 100644
--- a/ansible/deploy.yml
+++ b/ansible/deploy.yml
@@ -24,6 +24,12 @@
         src: "{{ artifact_path }}/docker-compose.arm64.yml"
         dest: "{{ deploy_dir }}/docker-compose.yml"
 
+    - name: Create .env file
+      ansible.builtin.copy:
+        content: "JWT_SECRET={{ jwt_secret }}\n"
+        dest: "{{ deploy_dir }}/.env"
+        mode: "0600"
+
     - name: Load Docker image
       ansible.builtin.command: docker load -i {{ deploy_dir }}/brainwave-arm64.tar.gz
       register: docker_load_result