Fix ssh key issues

.env.example

@@ -1,3 +1,70 @@
+# Example environment file for apparel-designer.
+#
+# Copy this to `.env` and adjust values as needed. Compose reads
+# `.env` automatically for variable substitution in docker-compose.yml
+# AND passes the values as runtime environment to the running
+# container, so a single file covers both build-time and runtime.
+#
+# ──────────────────────────────────────────────────────────────────
+# Runtime — values the server reads at startup
+# ──────────────────────────────────────────────────────────────────
+
+# HTTP port the Express server binds to. Matches the host-side port
+# in docker-compose.yml's `ports:` mapping.
 PORT=3001
+
+# `production` enables prod-only behavior in server.js (production
+# stickers path under dist/, production-mode logger). Use
+# `development` locally to read stickers from public/ instead.
 NODE_ENV=development
+
+# Pino log level. Comment out for `info` (default). Useful values:
+#   trace, debug, info, warn, error, fatal
+# Set to `debug` when diagnosing a problem; revert before deploy.
+# LOG_LEVEL=info
+
+# CORS — uncomment and set when the frontend is served from a
+# different origin than this API. Single origin or comma-separated.
 # CORS_ORIGIN=https://your-domain.com
+
+# Upload / export TTL and sweep interval, in milliseconds.
+# Defaults (24h TTL, 1h sweep) work for most cases. Lower the TTL
+# if disk space is tight; lower the interval if uploads churn fast
+# and you want stale files cleaned sooner.
+# FILE_TTL_MS=86400000          # 24 hours
+# CLEANUP_INTERVAL_MS=3600000   # 1 hour
+
+# ──────────────────────────────────────────────────────────────────
+# Build-time — values the `docker compose build` step uses
+# ──────────────────────────────────────────────────────────────────
+# These are only needed when BUILDING the image, not when running
+# it. The image talks to git.kadil.dev to fetch the `goods-editor`
+# git+ssh: npm dependency during `npm install`. See the docblock
+# in Dockerfile for the full mechanism.
+#
+# ── Option A: file-based key (typical local dev / single deploy host)
+# Set this to the absolute path of a private SSH key that has read
+# access to the goods-editor-module repo. The key file stays on
+# disk; only its contents are mounted into the build for the one
+# RUN step that needs it, and nothing about it ends up in the
+# image layers.
+#
+# Recommended: generate a dedicated read-only deploy key rather
+# than reusing a personal key (see Dockerfile docblock for the
+# ssh-keygen + Gitea deploy-key registration steps).
+#
+# Examples (uncomment one):
+# SSH_KEY_FILE=/Users/khalid/.ssh/goods-editor-deploy
+# SSH_KEY_FILE=/home/deploy/.ssh/goods-editor-deploy
+
+# ── Option B: env-var-based key (typical CI)
+# Pass the key contents directly via SSH_PRIVATE_KEY. Don't put
+# the actual key in this .env file (multi-line values are fragile
+# in env files, and committing a key — even .env.example with
+# real material — is a leak waiting to happen). Set it from the
+# shell or from your CI's secret store:
+#
+#   SSH_PRIVATE_KEY="$(cat ~/.ssh/goods-editor-deploy)" docker compose build
+#
+# To use this mode, also flip docker-compose.yml's `secrets.ssh_key`
+# block from `file:` to `environment:` (see comments there).