try moving config

Author: snow-jallen

.github/workflows/deploy.yml

@@ -35,13 +35,11 @@ jobs:
         sudo openssl pkcs12 -export -out certificate.pfx -inkey ${HOSTNAME}.boston-cloud.ts.net.key -in ${HOSTNAME}.boston-cloud.ts.net.crt -passout pass:
         sudo chown piuser. certificate.pfx
 
-    - name: Write environment variables to .env file
+    - name: Write deployment variables to .env file
       env:
-        GOVEE_API_KEY: ${{ secrets.GOVEE_API_KEY }}
         AIRPLAY_NAME: "${{ matrix.airplay_name }}"
       run: |
         cat > .env << EOF
-        GOVEE_API_KEY=${GOVEE_API_KEY}
         AIRPLAY_NAME=${AIRPLAY_NAME}
         HOMESPEAKER_IMAGE=ghcr.io/${{ github.repository_owner }}/homespeaker:latest
         EOF

.gitignore

@@ -352,6 +352,7 @@ healthchecksdb
 .env
 .env.local
 .env.production
+homespeaker-secrets.env
 # Squad: ignore runtime state (logs, inbox, sessions)
 .squad/orchestration-log/
 .squad/log/

docker-compose.yml

@@ -20,6 +20,11 @@ services:
     - "/sys/class/backlight/10-0045:/sys/class/backlight/10-0045"
     - airplay-shared:/tmp/airplay-shared  # Shared volume for AirPlay state
     - /run/user/1000/pulse:/run/user/1000/pulse:rw
+    # Persistent secrets file — create this once on each Pi, never committed to git.
+    # See: /home/piuser/homespeaker-secrets.env (example below)
+    env_file:
+      - path: /home/piuser/homespeaker-secrets.env
+        required: false  # Gracefully skip if file doesn't exist yet
     depends_on:
     - aspire    
     environment:
@@ -32,15 +37,13 @@ services:
     - OTEL_EXPORTER_OTLP_PROTOCOL=grpc
     - OTEL_EXPORTER_OTLP_ENDPOINT=http://aspire:18889
     - OTEL_SERVICE_NAME=HomeSpeaker
-    - NIGHTSCOUT_URL=https://janedoe.azurewebsites.net
-    - Temperature__ApiKey=${GOVEE_API_KEY}
     - PULSE_SERVER=unix:/run/user/1000/pulse/native
     networks:
       speakernet:
 
   aspire:
     container_name: aspire
-    image: mcr.microsoft.com/dotnet/aspire-dashboard:9.0
+    image: mcr.microsoft.com/dotnet/aspire-dashboard
     environment:
     - DOTNET_DASHBOARD_UNSECURED_ALLOW_ANONYMOUS=true
     ports:

homespeaker-secrets.env.example

@@ -0,0 +1,14 @@
+# HomeSpeaker secrets file
+# Copy this to /home/piuser/homespeaker-secrets.env on each Raspberry Pi.
+# That file is read by docker-compose at startup and on every manual restart.
+# It is never written or overwritten by the GitHub Actions deployment workflow.
+
+# --- Nightscout ---
+# Your Nightscout CGM data URL (leave blank to disable the widget)
+NIGHTSCOUT_URL=https://your-name.azurewebsites.net
+
+# --- Govee temperature sensors ---
+# Get your API key from the Govee Home app → Profile → About → Apply for API Key
+# Both values are required for the temperature widget to appear.
+Temperature__ApiKey=your-govee-api-key-here
+Temperature__ApiBaseUrl=https://openapi.api.govee.com