vaultwarden: fix formatting

Removes timetracker staging containers/volumes/images whose branch no
longer exists on Gitea. Backstop for missed branch-delete events from
the staging workflow in the timetracker repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -32,6 +32,8 @@ secrets:
     file: secrets/igdb_api_client_secret
   hardcover_api_token:
     file: secrets/hardcover_api_token
+  timetracker_secret_key:
+    file: secrets/timetracker_secret_key
 
 configs:
   caddyfile:
@@ -176,12 +178,15 @@ services:
   timetracker:
     image: ${REGISTRY_URL}/timetracker
     container_name: timetracker
+    secrets:
+      - timetracker_secret_key
     environment:
       - TZ=${TZ}
-      - "CSRF_TRUSTED_ORIGINS=https://tracker.kucharczyk.xyz"
+      - "APP_URL=https://tracker.kucharczyk.xyz"
       - PUID=${PUID}
       - PGID=${PGID}
       - DATA_DIR=/home/timetracker/app/data
+      - SECRET_KEY__FILE=/run/secrets/timetracker_secret_key
     volumes:
       - "${DOCKER_STORAGE_PATH}/timetracker/data:/home/timetracker/app/data"
       - "${DOCKER_STORAGE_PATH}/timetracker/backups:/home/timetracker/app/games/fixtures/backups"

scripts/staging-reaper.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Removes timetracker staging containers (deployed by .gitea/workflows/staging.yml
+# in the timetracker repo) whose branch no longer exists on Gitea.
+# Backstop for missed branch-delete events; safe to run any time.
+set -euo pipefail
+
+API="https://git.kucharczyk.xyz/api/v1/repos/lukas/timetracker/branches?limit=50"
+
+# If the API is unreachable, set -e aborts here and nothing gets reaped.
+branches=$(curl -fsS "$API" | python3 -c 'import json,sys; print("\n".join(b["name"] for b in json.load(sys.stdin)))')
+
+docker ps -a --filter label=xyz.kucharczyk.staging=timetracker --format '{{.Names}}' | while read -r name; do
+  branch=$(docker inspect "$name" --format '{{ index .Config.Labels "xyz.kucharczyk.staging.branch" }}')
+  if ! grep -qxF "$branch" <<<"$branches"; then
+    image=$(docker inspect "$name" --format '{{ .Config.Image }}')
+    docker rm -f "$name" >/dev/null
+    docker volume rm "$name" >/dev/null 2>&1 || true
+    docker rmi "$image" >/dev/null 2>&1 || true
+    echo "reaped ${name} (branch '${branch}' no longer exists)"
+  fi
+done