Configure both services exclusively via environment variables

API server (exercisediary-api):
- Replace conf.Get(file) with conf.GetFromEnv() — no config file required at startup
- PORT, HOST, THEME, COLOR, HEATCOLOR, PAGESTEP, AUTH* read from env vars
- API_KEY read from env var (replaces -k flag)
- DATA_DIR env var sets the data directory; -d flag still overrides it
- conf.Write() is now a no-op when ConfPath is empty (env-var mode)
- Removed -p and -k flags from cmd/api

Frontend server (exercisediary-frontend):
- Removed all flags; configuration is 100% env vars
- PORT, API_URL, API_KEY, NODE_PATH env vars with sensible defaults

docker-compose.yml / docker-compose-local.yml:
- All env vars documented inline with commented examples for optional settings

README:
- Split configuration section into per-service env var tables
- Update quick-start docker run example to use -e instead of flags

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: rwlove

README.md

@@ -52,47 +52,44 @@ docker run --name exdiary-api \
 
 # Start the web frontend
 docker run --name exdiary-frontend \
+  -e API_URL=http://<YOUR_HOST_IP>:8851 \
   -p 8080:8080 \
-  ghcr.io/rwlove/exercisediary-frontend \
-  -a http://<YOUR_HOST_IP>:8851
+  ghcr.io/rwlove/exercisediary-frontend
 ```
 
 Then open **http://localhost:8080** in your browser.
 
 ## Configuration
 
-Configuration is read from `config.yaml` or environment variables on the **API** server.
+Both services are configured exclusively via environment variables. No config file is required.
+
+### API server (`exercisediary-api`)
 
 | Variable | Description | Default |
 |---|---|---|
-| `AUTH` | Enable session-cookie authentication | `false` |
-| `AUTH_EXPIRE` | Session expiration: number + suffix `m`, `h`, `d`, or `M` | `7d` |
-| `AUTH_USER` | Username | `""` |
-| `AUTH_PASSWORD` | bcrypt-hashed password — [how to generate](docs/BCRYPT.md) | `""` |
+| `PORT` | Listen port | `8851` |
 | `HOST` | Listen address | `0.0.0.0` |
-| `PORT` | API listen port | `8851` |
-| `THEME` | Any [Bootswatch](https://bootswatch.com) theme name (lowercase) or extras: `emerald`, `grass`, `grayscale`, `ocean`, `sand`, `wood` | `grass` |
+| `DATA_DIR` | SQLite data directory (also settable via `-d` flag) | `/data/ExerciseDiary` |
+| `API_KEY` | Require this value on every `X-Api-Key` request header; empty = no auth | `""` |
+| `THEME` | Any [Bootswatch](https://bootswatch.com) theme (lowercase) or extras: `emerald`, `grass`, `grayscale`, `ocean`, `sand`, `wood` | `grass` |
 | `COLOR` | Background: `light` or `dark` | `light` |
 | `HEATCOLOR` | Heatmap cell color | `#03a70c` |
 | `PAGESTEP` | Rows per page | `10` |
-| `TZ` | Timezone (required for correct date display) | `""` |
-
-## API server options
-
-| Flag | Description | Default |
-|---|---|---|
-| `-d` | Path to data/config directory | `/data/ExerciseDiary` |
-| `-p` | Port to listen on | `8851` |
-| `-k` | API key required on `X-Api-Key` header (empty = no auth) | `""` |
+| `AUTH` | Enable session-cookie authentication | `false` |
+| `AUTH_USER` | Username | `""` |
+| `AUTH_PASSWORD` | bcrypt-hashed password — [how to generate](docs/BCRYPT.md) | `""` |
+| `AUTH_EXPIRE` | Session expiration: number + suffix `m`, `h`, `d`, or `M` | `7d` |
+| `TZ` | Timezone | `""` |
 
-## Frontend options
+### Frontend server (`exercisediary-frontend`)
 
-| Flag | Description | Default |
+| Variable | Description | Default |
 |---|---|---|
-| `-a` | Base URL of the API server | `http://localhost:8851` |
-| `-p` | Port to listen on | `8080` |
-| `-k` | API key sent to the API server | `""` |
-| `-n` | Path to local node_modules ([node-bootstrap](https://github.com/aceberg/my-dockerfiles/tree/main/node-bootstrap)) | `""` |
+| `PORT` | Listen port | `8080` |
+| `API_URL` | Base URL of the API server | `http://localhost:8851` |
+| `API_KEY` | `X-Api-Key` value sent to the API (must match API server `API_KEY`) | `""` |
+| `NODE_PATH` | URL of a [node-bootstrap](https://github.com/aceberg/my-dockerfiles/tree/main/node-bootstrap) instance for offline use | `""` |
+| `TZ` | Timezone | `""` |
 
 ## Local network only
 
@@ -113,6 +110,16 @@ docker run --name exdiary-frontend \
 
 Or use [docker-compose-local.yml](docker-compose-local.yml) to build both images from source.
 
+Set `NODE_PATH` on the frontend to point at the node-bootstrap instance:
+
+```sh
+docker run --name exdiary-frontend \
+  -e API_URL=http://<YOUR_HOST_IP>:8851 \
+  -e NODE_PATH=http://<YOUR_HOST_IP>:8850 \
+  -p 8080:8080 \
+  ghcr.io/rwlove/exercisediary-frontend
+```
+
 ## Thanks
 
 - All Go packages listed in [dependencies](https://github.com/aceberg/exercisediary/network/dependencies)

cmd/api/main.go

@@ -2,23 +2,21 @@ package main
 
 import (
 	"flag"
+	"os"
 
 	_ "time/tzdata"
 
 	"github.com/aceberg/ExerciseDiary/internal/api"
 )
 
-const (
-	defaultDirPath = "/data/ExerciseDiary"
-	defaultPort    = "8851"
-	defaultAPIKey  = ""
-)
-
 func main() {
-	dirPtr := flag.String("d", defaultDirPath, "Path to data/config directory")
-	portPtr := flag.String("p", defaultPort, "Port to listen on")
-	keyPtr := flag.String("k", defaultAPIKey, "API key required on X-Api-Key header (empty = no auth)")
+	// DATA_DIR env var sets the data directory; -d flag overrides it.
+	dataDir := os.Getenv("DATA_DIR")
+	if dataDir == "" {
+		dataDir = "/data/ExerciseDiary"
+	}
+	flag.StringVar(&dataDir, "d", dataDir, "Path to data directory (overrides DATA_DIR env var)")
 	flag.Parse()
 
-	api.Start(*dirPtr, *portPtr, *keyPtr)
+	api.Start(dataDir)
 }

cmd/frontend/main.go

@@ -1,28 +1,33 @@
 package main
 
 import (
-	"flag"
+	"os"
 
 	_ "time/tzdata"
 
 	"github.com/aceberg/ExerciseDiary/internal/store"
 	"github.com/aceberg/ExerciseDiary/internal/web"
 )
 
-const (
-	defaultPort   = "8080"
-	defaultAPIURL = "http://localhost:8851"
-	defaultAPIKey = ""
-	defaultNode   = ""
-)
+func envOr(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}
 
+// All configuration is read from environment variables:
+//
+//	PORT      listen port for the web UI  (default: 8080)
+//	API_URL   base URL of the API server  (default: http://localhost:8851)
+//	API_KEY   X-Api-Key sent to the API   (default: "", no auth)
+//	NODE_PATH path to local node_modules  (default: "", use CDN)
 func main() {
-	portPtr := flag.String("p", defaultPort, "Port for the frontend to listen on")
-	apiURLPtr := flag.String("a", defaultAPIURL, "Base URL of the ExerciseDiary API server")
-	keyPtr := flag.String("k", defaultAPIKey, "API key sent to the API server (X-Api-Key header)")
-	nodePtr := flag.String("n", defaultNode, "Path to node_modules (empty = use CDN)")
-	flag.Parse()
+	port := envOr("PORT", "8080")
+	apiURL := envOr("API_URL", "http://localhost:8851")
+	apiKey := envOr("API_KEY", "")
+	nodePath := envOr("NODE_PATH", "")
 
-	ac := store.NewAPIClient(*apiURLPtr, *keyPtr)
-	web.GuiWithStore(ac, ac, *portPtr, *nodePtr)
+	ac := store.NewAPIClient(apiURL, apiKey)
+	web.GuiWithStore(ac, ac, port, nodePath)
 }

docker-compose-local.yml

@@ -6,21 +6,35 @@ services:
       dockerfile: Dockerfile.api
     restart: unless-stopped
     ports:
-    - 8851:8851
+      - "8851:8851"
     volumes:
-    - ~/.dockerdata/ExerciseDiary:/data/ExerciseDiary
+      - ~/.dockerdata/ExerciseDiary:/data/ExerciseDiary
     environment:
       TZ: America/New_York
+      PORT: "8851"
+      HOST: "0.0.0.0"
+      THEME: "grass"
+      COLOR: "light"
+      HEATCOLOR: "#03a70c"
+      PAGESTEP: "10"
+      # API_KEY: "changeme"
+      # AUTH: "true"
+      # AUTH_USER: "admin"
+      # AUTH_PASSWORD: ""
+      # AUTH_EXPIRE: "7d"
 
   exdiary-frontend:
     build:
       context: .
       dockerfile: Dockerfile.frontend
     restart: unless-stopped
     ports:
-    - 8080:8080
-    command: "-a http://exdiary-api:8851"
+      - "8080:8080"
     depends_on:
       - exdiary-api
     environment:
       TZ: America/New_York
+      PORT: "8080"
+      API_URL: "http://exdiary-api:8851"
+      # API_KEY: "changeme"
+      # NODE_PATH: ""

docker-compose.yml

@@ -4,19 +4,33 @@ services:
     image: ghcr.io/rwlove/exercisediary-api:latest
     restart: unless-stopped
     ports:
-    - 8851:8851
+      - "8851:8851"
     volumes:
-    - ~/.dockerdata/ExerciseDiary:/data/ExerciseDiary
+      - ~/.dockerdata/ExerciseDiary:/data/ExerciseDiary
     environment:
-      TZ: America/New_York    # required, default: ""
+      TZ: America/New_York
+      PORT: "8851"
+      HOST: "0.0.0.0"
+      THEME: "grass"
+      COLOR: "light"
+      HEATCOLOR: "#03a70c"
+      PAGESTEP: "10"
+      # API_KEY: "changeme"         # uncomment to require X-Api-Key on every request
+      # AUTH: "true"                # uncomment to enable session auth
+      # AUTH_USER: "admin"
+      # AUTH_PASSWORD: ""           # bcrypt hash — see docs/BCRYPT.md
+      # AUTH_EXPIRE: "7d"
 
   exdiary-frontend:
     image: ghcr.io/rwlove/exercisediary-frontend:latest
     restart: unless-stopped
     ports:
-    - 8080:8080
-    command: "-a http://exdiary-api:8851"
+      - "8080:8080"
     depends_on:
       - exdiary-api
     environment:
-      TZ: America/New_York    # required, default: ""
+      TZ: America/New_York
+      PORT: "8080"
+      API_URL: "http://exdiary-api:8851"
+      # API_KEY: "changeme"         # must match exdiary-api API_KEY when set
+      # NODE_PATH: ""               # set to local node-bootstrap URL for offline use

internal/api/server.go

@@ -3,6 +3,7 @@ package api
 import (
 	"log"
 	"net/http"
+	"os"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
@@ -20,16 +21,32 @@ var (
 	dataStore store.Store
 )
 
-// Start initialises the database, reads config, and begins serving the JSON API.
-func Start(dirPath, port, apiKey string) {
-	confPath := dirPath + "/config.yaml"
-	check.Path(confPath)
-
-	appConfig, authConf = conf.Get(confPath)
-	appConfig.DirPath = dirPath
-	appConfig.DBPath = dirPath + "/sqlite.db"
+// Start initialises the database, reads config from environment variables,
+// and begins serving the JSON API.
+//
+// dataDir is the only required parameter — it sets where the SQLite database
+// lives. All other settings (port, API key, theme, auth, …) are read from
+// environment variables:
+//
+//	PORT        listen port              (default: 8851)
+//	API_KEY     required X-Api-Key value (default: "", no auth)
+//	HOST        listen host              (default: 0.0.0.0)
+//	THEME       UI theme                 (default: grass)
+//	COLOR       light or dark            (default: light)
+//	HEATCOLOR   heatmap colour           (default: #03a70c)
+//	PAGESTEP    rows per page            (default: 10)
+//	AUTH        enable session auth      (default: false)
+//	AUTH_USER   username                 (default: "")
+//	AUTH_PASSWORD bcrypt password        (default: "")
+//	AUTH_EXPIRE session expiry           (default: 7d)
+func Start(dataDir string) {
+	appConfig, authConf = conf.GetFromEnv()
+	appConfig.DirPath = dataDir
+	appConfig.DBPath = dataDir + "/sqlite.db"
+	// ConfPath left empty — Settings changes are in-memory only in env-var mode.
 	check.Path(appConfig.DBPath)
-	appConfig.ConfPath = confPath
+
+	apiKey := os.Getenv("API_KEY")
 
 	log.Println("INFO: starting API server, db =", appConfig.DBPath)
 
@@ -39,7 +56,7 @@ func Start(dirPath, port, apiKey string) {
 	gin.SetMode(gin.ReleaseMode)
 	r := gin.Default()
 
-	// API key middleware (optional – skip when apiKey is empty)
+	// API key middleware (optional – skip when API_KEY is unset)
 	if apiKey != "" {
 		r.Use(apiKeyMiddleware(apiKey))
 	}
@@ -64,7 +81,7 @@ func Start(dirPath, port, apiKey string) {
 	r.PUT("/api/config", putConfig)
 	r.PUT("/api/config/auth", putConfigAuth)
 
-	address := "0.0.0.0:" + port
+	address := appConfig.Host + ":" + appConfig.Port
 	log.Println("=================================== ")
 	log.Printf("API server at http://%s", address)
 	log.Println("=================================== ")