The ${VAR:-default} syntax caused shell quoting errors inside the
bun -e argument. Instead, skip Infisical values for vars already
set via docker-compose environment.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uses ${VAR:-default} pattern so pre-set env vars (from .env or
docker-compose) are not overwritten by Infisical values. Useful
when a secret needs regeneration but Infisical can't be updated
via the read-only machine identity.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Production gateway rejects the access token (error 1002). Staging
flow works end-to-end. Will switch back once Transak whitelists
the server IP for production.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Infisical still has the staging key; override in entrypoint until
the dashboard is updated with write-access credentials.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add entrypoint.sh that authenticates with Infisical via universal-auth
and injects secrets as env vars before starting the Bun server.
Uses Bun's built-in fetch API instead of Node.js http module.
Secrets removed from docker-compose.yml (now fetched at runtime):
INTERNAL_API_KEY, HETZNER_API_TOKEN, CLOUDFLARE_API_TOKEN,
CLOUDFLARE_ZONE_ID, TWENTY_API_TOKEN, R2_*, X402_*, SMTP_PASS
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Jeff Emmett