docker-compose.prod.yml

@@ -90,6 +90,14 @@
 #   USPS_CLIENT_ID        Optional. Leave unset to run without address
 #   USPS_CLIENT_SECRET    validation; the app degrades gracefully rather than
 #                         failing, so an empty value is a working configuration.
+#   ANTHROPIC_API_KEY     Optional. Drafts a listing from a submitted photo
+#                         (#223). Unset means submissions still arrive and wait
+#                         undrafted, which is a working configuration for the
+#                         same reason USPS is. The one credential here that
+#                         spends money per call, and on a path anybody holding
+#                         an upload link can trigger — put a spend limit on the
+#                         key in the Anthropic console, because nothing in this
+#                         repository can enforce one.
 #
 # The names above are what this file reads. A stack variable under any other
 # name is substituted nowhere and never reaches the container, so reconciling
@@ -202,6 +210,21 @@ services:
       # this same container, and a certificate that covers it. Until then the
       # server warns at boot that the defence is off rather than staying silent.
       - UPLOADS_BASE_URL=${UPLOADS_BASE_URL:-}
+
+      # Drafts a listing from a submitted photo (#223).
+      #
+      # Absent is a working configuration, deliberately. A submission still
+      # arrives, keeps its photos and waits in the queue undrafted — losing
+      # somebody's consignment to an expired key would be far worse than an
+      # item arriving without its description written, and the photos may be
+      # the only copy of an item no longer in the sender's hands.
+      #
+      # The one credential in this stack that spends money per call, on a path
+      # anybody holding an upload link can trigger. Set a spend limit on the
+      # key in the Anthropic console — nothing in this repository can enforce
+      # one, and #227 is the submission ceiling that bounds the volume rather
+      # than the bill.
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
     volumes:
       # Production's own uploads directory. QA writes to
       # /volume1/configs/redefined-designs-qa/uploads; sharing this one would

docker-compose.qa.yml

@@ -40,6 +40,13 @@
 #   ADMIN_GATE_SECRET — the shared secret Nginx Proxy Manager injects as the
 #                     X-Admin-Gate header on the gated location. Both sides must
 #                     hold the same value or the admin API returns 403. See #63.
+#   QA_ANTHROPIC_API_KEY — optional. Drafts a listing from a submitted photo
+#                     (#223). QA_ prefixed like the others so production's key
+#                     cannot be pasted here by accident, and worth its own key
+#                     rather than sharing production's: this is the only
+#                     credential here that spends money per call, and it is
+#                     reachable by anyone holding an upload link. Leave it unset
+#                     and submissions still arrive, undrafted.
 
 services:
   redefined-designs-qa:
@@ -114,6 +121,18 @@ services:
       # enough: stack variables are substituted into this file, not handed to
       # the container, so a variable with no line here never reaches the app.
       - ADMIN_GATE_SECRET=${ADMIN_GATE_SECRET}
+
+      # Drafts a listing from a submitted photo (#223). Named QA_ in the stack
+      # for the same reason as the database and SMTP credentials: pasting
+      # production's variables in here must not silently work — and this is the
+      # one credential in the stack that costs money per call, on a path a
+      # stranger with a link can trigger.
+      #
+      # Absent is a working configuration. A submission still arrives, keeps
+      # its photos and waits in the queue undrafted, because losing somebody's
+      # consignment to an expired key would be far worse than an item arriving
+      # without its description written.
+      - ANTHROPIC_API_KEY=${QA_ANTHROPIC_API_KEY}
     volumes:
       # Separate uploads directory. Sharing production's would let a QA run
       # write into, and a QA teardown delete, real product images.

docs/ops/production-stack-cutover.md

@@ -60,7 +60,7 @@ Everything here is lost when the stack is deleted, and the rollback in step 8 is
 
 **The stack name**, exactly as Portainer shows it. If it is not `redefined-designs`, note that — the new stack must be created with that name, because the stack name becomes the compose project name and reusing QA's would make Compose reconcile the two against each other.
 
-**Every stack environment variable, name and value.** They belong to the stack, and deleting it discards them. This is the step whose omission is felt hardest. The compose file interpolates thirteen names — `DEMO_MODE`, `DB_PASSWORD`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_FROM`, `ADMIN_GATE_SECRET`, `PAYPAL_CLIENT_ID`, `PAYPAL_CLIENT_SECRET`, `PAYPAL_WEBHOOK_ID`, `USPS_CLIENT_ID`, `USPS_CLIENT_SECRET`, `UPLOADS_BASE_URL` and `BACKUP_PASSPHRASE` — and an unset one substitutes to an empty string rather than failing. None of it is recoverable from anything in this repository. Take everything the stack holds rather than working from this list; it is here to say how much there is, and it is checked against the file rather than from memory.
+**Every stack environment variable, name and value.** They belong to the stack, and deleting it discards them. This is the step whose omission is felt hardest. The compose file interpolates fourteen names — `DEMO_MODE`, `DB_PASSWORD`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_FROM`, `ADMIN_GATE_SECRET`, `PAYPAL_CLIENT_ID`, `PAYPAL_CLIENT_SECRET`, `PAYPAL_WEBHOOK_ID`, `USPS_CLIENT_ID`, `USPS_CLIENT_SECRET`, `UPLOADS_BASE_URL`, `BACKUP_PASSPHRASE` and `ANTHROPIC_API_KEY` — and an unset one substitutes to an empty string rather than failing. None of it is recoverable from anything in this repository. Take everything the stack holds rather than working from this list; it is here to say how much there is, and it is checked against the file rather than from memory.
 
 `USPS_CLIENT_ID` and `USPS_CLIENT_SECRET` deserve naming because losing them is the one failure here that is completely silent. Address validation is skipped when they are empty rather than failing, so checkout keeps working and quietly stops validating addresses. Nothing in step 7 catches it, and there is no crash loop to notice.