[Kinghezzy]

Summary

Build/deploy hardening: slim migrate stage, runtime frontend config, env var reconciliation

What was solved

#100 — Slim down the backend migrate image

Slim the backend migrate Docker target so the init/migration image contains only what drizzle-kit needs (drizzle-kit, config, and migrations) instead of the full build stage with dev deps, sources, and compilers.

Addressed:

• Changed: backend/Dockerfile
• Modify backend/Dockerfile to add a minimal migrate stage
• The migrate stage must include only drizzle-kit, the drizzle config, and the migrations directory
• Do not change other Dockerfile stages (build/dev/production) beyond what is needed to support the slim migrate stage

#101 — Support runtime configuration for the frontend image

Add runtime frontend configuration so a single frontend image can serve staging and production: generate /config.js at container start from environment variables in frontend/Dockerfile, and update the k8s deploy workflow to pass runtime env vars instead of relying on build-time VITE_* values.

Addressed:

• Changed: frontend/Dockerfile, .github/workflows/deploy-k8s.yml, k8s/frontend-deployment.yaml, k8s/configmap.yaml
• Serve a /config.js generated at container start from env vars (frontend/Dockerfile entrypoint/startup script)
• Update .github/workflows/deploy-k8s.yml to supply runtime configuration env vars for the frontend image
• Coordinate with SynapsVault/frontend (document/align the runtime config contract, e.g. window.APP_CONFIG or similar)

#102 — Track removal of --legacy-peer-deps from the Dockerfiles

Document the temporary --legacy-peer-deps workaround in both Dockerfiles by adding tracking comments that reference the upstream peer-dependency conflicts (x402-stellar vs stellar-sdk in the backend, missing frontend lockfile) and note the condition for dropping the flag. This satisfies the tracking/linking intent without changing build behavior, since the flag cannot be removed until upstream issues are resolved.

Addressed:

• Changed: backend/Dockerfile, frontend/Dockerfile
• Add tracking comments in backend/Dockerfile explaining why --legacy-peer-deps is used (x402-stellar vs stellar-sdk peer conflict) and referencing the upstream issue to link
• Add tracking comments in frontend/Dockerfile explaining why --legacy-peer-deps is used (missing frontend lockfile) and referencing the upstream issue to link
• Keep the --legacy-peer-deps flag in place; do not drop it since upstream issues are unresolved

#103 — Environment variable names are inconsistent between .env.example, ConfigMap and Secret

Reconcile environment variable names across .env.example, k8s/configmap.yaml, k8s/secrets.yaml, and docs/ENVIRONMENT-VARIABLES.md so they match what the backend actually reads. Fix mismatches like STELLAR_SOROBAN_RPC_URL vs SOROBAN_RPC_URL, SUPABASE_SERVICE_ROLE_KEY vs SUPABASE_SERVICE_KEY, single STELLAR_CONTRACT_ID vs three contract IDs, and add missing AGENT_SECRET_KEY, REGISTRY_SECRET_KEY, OPENROUTER_API_KEY, and USDC_CONTRACT_ID entries.

Addressed:

• Changed: .env.example, k8s/configmap.yaml, k8s/secrets.yaml, docs/ENVIRONMENT-VARIABLES.md
• Reconcile variable names with what the backend reads (source of truth is backend code)
• Update .env.example to use consistent names and add missing AGENT_SECRET_KEY, REGISTRY_SECRET_KEY, OPENROUTER_API_KEY, USDC_CONTRACT_ID
• Update k8s/configmap.yaml to use the reconciled non-secret variable names

Changes

• backend/Dockerfile (modify)
• .github/workflows/deploy-k8s.yml (modify)
• k8s/frontend-deployment.yaml (modify)
• .env.example (modify)
• k8s/secrets.yaml (modify)
• frontend/Dockerfile (modify)
• k8s/configmap.yaml (modify)
• docs/ENVIRONMENT-VARIABLES.md (modify)

Approach

1. Slim down the backend migrate image #100 — Slim down the backend migrate image (Changed: backend/Dockerfile)
2. Support runtime configuration for the frontend image #101 — Support runtime configuration for the frontend image (Changed: frontend/Dockerfile, .github/workflows/deploy-k8s.yml, k8s/frontend-deployment.yaml, k8s/configmap.yaml)
3. Track removal of --legacy-peer-deps from the Dockerfiles #102 — Track removal of --legacy-peer-deps from the Dockerfiles (Changed: backend/Dockerfile, frontend/Dockerfile)
4. Environment variable names are inconsistent between .env.example, ConfigMap and Secret #103 — Environment variable names are inconsistent between .env.example, ConfigMap and Secret (Changed: .env.example, k8s/configmap.yaml, k8s/secrets.yaml, docs/ENVIRONMENT-VARIABLES.md)

Issues

Closes #100
Closes #101
Closes #102
Closes #103

[drips-wave]

@Kinghezzy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits