Add support for more file secret

[ildyria]

Summary by CodeRabbit

• New Features

  • Added support for loading confidential credentials from Docker and Kubernetes secret files.
  • Added optional NSFW classification and reverse-geocoding services for local deployments.
  • Added configuration examples for email delivery, cloud credentials, AI Vision, OAuth, and other integrations.

• Bug Fixes

  • Improved environment validation for missing or unreadable secret files while preserving optional credentials.
  • Updated facial-recognition configuration to remove insecure default API keys.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 97a0b947-9d73-4e26-a6c3-cc3e66e4cd95

📥 Commits

Reviewing files that changed from the base of the PR and between 4cd8eb6 and 98de6d7.

📒 Files selected for processing (2)

• docker-compose.yaml
• docker/scripts/01-validate-env.sh

🚧 Files skipped from review as they are similar to previous changes (2)

• docker/scripts/01-validate-env.sh
• docker-compose.yaml

---

📝 Walkthrough

Walkthrough

The change adds _FILE secret support to startup validation and documents the convention. Docker Compose gains credential examples, optional NSFW and geo-decoding sidecars, health checks, security settings, networking, and persistent queue storage.

Changes

Configuration and optional services

Layer / File(s)	Summary
Secret-file loading and configuration examples .env.example, docker/scripts/01-validate-env.sh, docker-compose.yaml	The startup script resolves configured secrets from matching _FILE paths. The examples document Mailgun, Postmark, OAuth, AWS, AI Vision, and other secret-file variables.
Optional service configuration docker-compose.yaml, .env.example	Docker Compose adds optional NSFW and geo-decoding sidecars, health checks, security settings, networking, and persistent NSFW queue storage. The facial-recognition default key is empty, and its internal expose setting is removed.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

I’m a rabbit with secrets tucked tight,
Files load at startup, clean and right.
NSFW hops in with a queue,
Geo-decoding joins the crew.
Compose checks health through the night.

🚥 Pre-merge checks | ✅ 1

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f7b4710e-ec3b-4d29-9f72-242d376a5536

📥 Commits

Reviewing files that changed from the base of the PR and between 007f3f4 and 4cd8eb6.

📒 Files selected for processing (3)

• .env.example
• docker-compose.yaml
• docker/scripts/01-validate-env.sh