merge muzick redis into shared infra stack, rotate secrets

.env.example

@@ -1,3 +1,12 @@
+# Database
+DB_PASSWORD=change-me
+
+# Shared redis (infra stack)
+REDIS_PASSWORD=change-me
+
+# Typesense search
+TYPESENSE_API_KEY=change-me
+
 # Last.fm API credentials (required for artist images, tags)
 LASTFM_API_KEY="your-lastfm-api-key"
 LASTFM_SHARED_SECRET="your-lastfm-shared-secret"

AUDIT.md

@@ -19,7 +19,6 @@ Audit the muzick project at `/home/kami/apps/muzick/`, file Vikunja tasks for fi
 
 ### Tasks filed
 - See Homelab infra project. Key items:
-  - #108: systemd service references dead Python venv (NEEDS FIX)
   - #109: pin Docker images (NEEDS FIX — minio:latest etc)
   - #110: N+1 queries in generators (PERFORMANCE)
   - #111: image proxy SSRF guard (SECURITY)
@@ -35,5 +34,4 @@ Audit the muzick project at `/home/kami/apps/muzick/`, file Vikunja tasks for fi
 8. **No input validation** on many routes (admin, library — `as any` casts)
 
 ### Remaining autonomous work items
-- #108 — Fix systemd service file (references dead Python venv) — CAN DO
 - #109 — Pin Docker images in docker-compose.yml — CAN DO

docker-compose.yml

@@ -4,22 +4,14 @@ services:
     restart: always
     environment:
       POSTGRES_USER: user
-      POSTGRES_PASSWORD: password
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_DB: muzick
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
     volumes:
       - ./data/postgres:/var/lib/postgresql/data
       - ./backend/src/db/schema.sql:/docker-entrypoint-initdb.d/schema.sql
 
-  redis:
-    image: redis:7
-    restart: always
-    ports:
-      - "6379:6379"
-    volumes:
-      - ./data/redis:/data
-
   search:
     image: typesense/typesense:0.25.1
     restart: always
@@ -27,23 +19,25 @@ services:
       - "8108:8108"
     volumes:
       - ./data/typesense:/data
-    command: --data-dir /data --api-key=muzick-key
+    command: --data-dir /data --api-key=${TYPESENSE_API_KEY}
 
   backend:
     build: ./backend
     ports:
       - "3000:3000"
     environment:
-      DATABASE_URL: postgresql://user:password@db:5432/muzick
-      REDIS_URL: redis://redis:6379
-      TYPESENSE_API_KEY: muzick-key
+      DATABASE_URL: postgresql://user:${DB_PASSWORD}@db:5432/muzick
+      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
+      TYPESENSE_API_KEY: ${TYPESENSE_API_KEY}
       MUSIC_DIR: /music
     volumes:
       - /mnt/hdd1/media/Music:/music:ro
     depends_on:
       - db
-      - redis
       - search
+    networks:
+      - default
+      - infra-net
 
   frontend:
     build: ./frontend
@@ -56,8 +50,8 @@ services:
     build: ./workers
     network_mode: host
     environment:
-      DATABASE_URL: postgresql://user:password@127.0.0.1:5432/muzick
-      REDIS_URL: redis://127.0.0.1:6379
+      DATABASE_URL: postgresql://user:${DB_PASSWORD}@127.0.0.1:5432/muzick
+      REDIS_URL: redis://:${REDIS_PASSWORD}@127.0.0.1:6379
       MUSICBRAINZ_CONTACT: ${MUSICBRAINZ_CONTACT}
       LASTFM_API_KEY: ${LASTFM_API_KEY}
       LASTFM_SHARED_SECRET: ${LASTFM_SHARED_SECRET}
@@ -66,3 +60,8 @@ services:
       MUSIC_DIR: /music
     volumes:
       - /mnt/hdd1/media/Music:/music:ro
+
+networks:
+  infra-net:
+    external: true
+    name: infra-net

muzick.service

@@ -1,16 +0,0 @@
-[Unit]
-Description=Muzick Music Player (Docker Compose)
-After=docker.service network.target
-Requires=docker.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-User=kami
-WorkingDirectory=/home/kami/apps/muzick
-ExecStart=/usr/bin/docker compose up -d
-ExecStop=/usr/bin/docker compose down
-Environment=COMPOSE_FILE=/home/kami/apps/muzick/docker-compose.yml
-
-[Install]
-WantedBy=multi-user.target