adventurelog: DEBUG=False on the backend — the image defaults to Django debug pages on the public origin (R-482)

2026-09-13 19:22:35 +02:00
parent 48d2003b7e
commit ed2c01855b
2 changed files with 17 additions and 0 deletions
@@ -19,6 +19,10 @@ services:
    environment:
      - DJANGO_SECRET_KEY=${SECRET_KEY}
      - SECRET_KEY=${SECRET_KEY}
+      # R-482: the image defaults DEBUG to True (settings: getenv('DEBUG','True')), which serves full
+      # Django debug pages — settings, paths, tracebacks — on the internet-facing origin. Measured
+      # 2026-09-13 on demo-hp. Upstream's own compose sets it False; so do we.
+      - DEBUG=False
      - PGHOST=adventurelog-postgres
      - PGDATABASE=adventurelog
      - PGUSER=adventurelog