From 47027c517da7a8d1cf1b34f4d61c7efba8c52e71 Mon Sep 17 00:00:00 2001
From: ZProger <zproger@users.noreply.github.com>
Date: Thu, 10 Sep 2026 19:45:16 +0300
Subject: [PATCH] =?UTF-8?q?feat:=20=D0=B0=D0=B2=D1=82=D0=BE=D1=81=D0=BE?=
 =?UTF-8?q?=D0=B7=D0=B4=D0=B0=D0=B2=D0=B0=D1=82=D1=8C=20.env=20=D0=B8?=
 =?UTF-8?q?=D0=B7=20.env.example=20=D0=BF=D1=80=D0=B8=20=D0=BF=D0=B5=D1=80?=
 =?UTF-8?q?=D0=B2=D0=BE=D0=BC=20=D0=B7=D0=B0=D0=BF=D1=83=D1=81=D0=BA=D0=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Раньше при отсутствии .env docker compose тихо стартовал на дефолтах
из docker-compose.yml (без пароля, дефолтные креды Postgres), никак
не сигнализируя об этом. Добавлен start.sh — обёртка над
docker compose up -d --build, которая при отсутствии .env создаёт его
из .env.example и один раз громко предупреждает об используемых
дефолтах перед стартом контейнеров. README обновлён на использование
этого скрипта.
---
 README.md |  4 +++-
 start.sh  | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100755 start.sh

diff --git a/README.md b/README.md
index 81af933..cce9db1 100644
--- a/README.md
+++ b/README.md
@@ -129,11 +129,13 @@ Everything else in `.env` (currency, CORS, the port Aurum listens on) has a sens
 ### 4. Start it
 
 ```bash
-docker compose up -d --build
+./start.sh
 ```
 
 This builds the backend and frontend images, starts Postgres, waits for it to report healthy, then starts the backend (which runs every database migration automatically — nothing to do by hand) and finally the frontend. First run takes a minute or two; after that, images are cached and it's seconds.
 
+`start.sh` is a thin wrapper around `docker compose up -d --build` — if you skipped step 3 and there's no `.env` yet, it creates one from `.env.example` and prints a warning about the defaults it's running on (no password, default Postgres credentials) before starting anything, instead of silently starting an unprotected instance. You can still run `docker compose up -d --build` directly if you prefer; just make sure `.env` exists first.
+
 ### 5. Open it
 
 Visit **http://localhost:3000** (or whatever port you set via `AURUM_WEB_PORT` in `.env`). A default account and the standard expense/income categories are seeded automatically — there's nothing to configure before you can add your first transaction.
diff --git a/start.sh b/start.sh
new file mode 100755
index 0000000..7ea237b
--- /dev/null
+++ b/start.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Thin wrapper around `docker compose up` that guarantees a .env file
+# exists before containers start. Running `docker compose up --build`
+# directly works fine even without .env — every variable in
+# docker-compose.yml and backend/app/core/config.py has a hardcoded
+# fallback — but that means someone who skips the README's "cp
+# .env.example .env" step gets a fully working instance with no visible
+# sign that it's running on defaults (weak Postgres password, no basic
+# auth — see frontend/docker-entrypoint.d/20-basic-auth.sh) until they
+# go looking for it. This script closes that gap: if .env is missing,
+# it's created from .env.example and the operator is told, loudly, once,
+# before anything starts — rather than staying silent forever.
+set -eu
+
+cd "$(dirname "$0")"
+
+if [ ! -f .env ]; then
+  cp .env.example .env
+  cat >&2 <<'EOF'
+[aurum] No .env file found — created one from .env.example with default values:
+[aurum]   - No password on the app itself (AURUM_BASIC_AUTH_USER/PASSWORD blank)
+[aurum]   - Default Postgres credentials (AURUM_POSTGRES_PASSWORD=change-me)
+[aurum] Fine for a quick local try-out on localhost. Before exposing this beyond
+[aurum] your own machine, edit .env and re-run this script (or `docker compose up -d --build`).
+EOF
+fi
+
+exec docker compose up -d --build "$@"