From 332fc486d254f90987c78ca01d1cfbc368d5f0c6 Mon Sep 17 00:00:00 2001
From: peskyadmin <peskyadmin@peskyadmins-Mac-mini.local>
Date: Sun, 2 Aug 2026 10:23:43 -0400
Subject: [PATCH] fix: use environment variables for TS_AUTHKEY and
 TS_LOGIN_SERVER

- docker-compose.yml: TS_AUTHKEY and TS_LOGIN_SERVER now read from environment
- README.md: updated Tailscale configuration instructions to reference env vars instead of editing the file
- Added .gitignore to prevent committing secrets or Tailscale state

This protects reusable test auth keys and custom coordination servers from being committed to any ts-* repo.
---
 .gitignore         | 9 +++++++++
 README.md          | 2 +-
 docker-compose.yml | 3 ++-
 3 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..10c6b93
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,9 @@
+# Secrets and environment files
+.env
+.env.*
+*.key
+tskey-*
+authkey*
+
+# Tailscale data (never commit state)
+tailscale/tailscale-data/
diff --git a/README.md b/README.md
index 421f25e..710b826 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ ts-{{service}}/
     mkdir -p tailscale/tailscale-data
     ```
 3. Configure Tailscale
-    - Replace `{{YOUR_TAILSCALE_AUTHKEY}}` in the docker-compose.yml with your actual Tailscale auth key
+    - Make sure `TS_AUTHKEY` and `TS_LOGIN_SERVER` are set in your environment (or a local `.env` file) before running docker compose.
     - Optionally, update the file in `tailscale/config/serve.json` if you need specific Tailscale serve configurations
         - CAUTION: Changing `"${TS_CERT_DOMAIN}:443": false` to `true` will expose the service to the internet
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 72aa767..1106e40 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,7 +4,8 @@ services:
     hostname: {{service}}
     container_name: {{service}}-ts
     environment:
-      - TS_AUTHKEY={{YOUR_TAILSCALE_AUTHKEY}}
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_LOGIN_SERVER=${TS_LOGIN_SERVER}
       - TS_STATE_DIR=/var/lib/tailscale
       - TS_SERVE_CONFIG=/config/serve.json
     volumes: