refactor(env): unify required-env validation through useRuntimeConfig

validate-env.js now reads all four required vars (MONGODB_URI, JWT_SECRET,
RESEND_API_KEY, HELCIM_API_TOKEN) from useRuntimeConfig() instead of mixing
direct process.env reads with a JWT-only special case. Mongoose and the six
Resend instantiations follow suit. Either bare or NUXT_-prefixed env names
are accepted, so Dokploy no longer needs duplicate entries.

Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM node:20-alpine AS builder
+FROM node:22-alpine AS builder
 
 WORKDIR /app
 COPY package*.json ./
@@ -10,7 +10,7 @@ RUN npm run build
 # Production stage — only the self-contained .output is needed.
 # bash + curl are added so Dokploy scheduled tasks (which wrap commands in
 # `bash -c "..."`) can run; alpine ships only ash and has no curl by default.
-FROM node:20-alpine
+FROM node:22-alpine
 RUN apk add --no-cache bash curl
 WORKDIR /app
 COPY --from=builder /app/.output .output

nuxt.config.ts

@@ -91,8 +91,7 @@ export default defineNuxtConfig({
   },
   runtimeConfig: {
     // Private keys (server-side only)
-    mongodbUri:
+    mongodbUri: process.env.MONGODB_URI || "",
-      process.env.MONGODB_URI || "mongodb://localhost:27017/ghostguild",
     jwtSecret: process.env.JWT_SECRET || "",
     resendApiKey: process.env.RESEND_API_KEY || "",
     helcimApiToken: process.env.HELCIM_API_TOKEN || "",

server/api/admin/members/invite.post.js

@@ -4,7 +4,7 @@ import { Resend } from 'resend'
 import Member from '../../../models/member.js'
 import { connectDB } from '../../../utils/mongoose.js'
 
-const resend = new Resend(process.env.RESEND_API_KEY)
+const resend = new Resend(useRuntimeConfig().resendApiKey)
 
 export default defineEventHandler(async (event) => {
   await requireAdmin(event)

server/api/admin/pre-registrants/invite.post.js

@@ -4,7 +4,7 @@ import { Resend } from 'resend'
 import PreRegistration from '../../../models/preRegistration.js'
 import { connectDB } from '../../../utils/mongoose.js'
 
-const resend = new Resend(process.env.RESEND_API_KEY)
+const resend = new Resend(useRuntimeConfig().resendApiKey)
 
 export default defineEventHandler(async (event) => {
   await requireAdmin(event)

server/plugins/validate-env.js

@@ -1,23 +1,17 @@
 export default defineNitroPlugin(() => {
-  const required = [
-    'MONGODB_URI',
-    'JWT_SECRET',
-    'RESEND_API_KEY',
-    'HELCIM_API_TOKEN',
-  ]
-
-  const missing = required.filter((key) => {
-    // Check both process.env and runtime config where applicable
-    if (key === 'JWT_SECRET') {
   const config = useRuntimeConfig()
-      return !config.jwtSecret
+  const checks = {
+    MONGODB_URI: config.mongodbUri,
+    JWT_SECRET: config.jwtSecret,
+    RESEND_API_KEY: config.resendApiKey,
+    HELCIM_API_TOKEN: config.helcimApiToken,
   }
-    return !process.env[key]
+
-  })
+  const missing = Object.entries(checks).filter(([, value]) => !value).map(([key]) => key)
 
   if (missing.length > 0) {
     console.error(`FATAL: Missing required environment variables: ${missing.join(', ')}`)
-    console.error('Set these in your .env file or environment variables.')
+    console.error('Set these (or their NUXT_-prefixed equivalents) in your .env file or environment variables.')
     process.exit(1)
   }
 })

server/routes/oidc/interaction/login.post.ts

@@ -12,7 +12,7 @@ import { Resend } from "resend";
 import Member from "../../../models/member.js";
 import { connectDB } from "../../../utils/mongoose.js";
 
-const resend = new Resend(process.env.RESEND_API_KEY);
+const resend = new Resend(useRuntimeConfig().resendApiKey);
 
 export default defineEventHandler(async (event) => {
   await connectDB();

server/utils/magicLink.js

@@ -6,7 +6,7 @@ import { randomUUID } from 'crypto'
 import { Resend } from 'resend'
 import Member from '../models/member.js'
 
-const resend = new Resend(process.env.RESEND_API_KEY)
+const resend = new Resend(useRuntimeConfig().resendApiKey)
 
 /**
  * Issue a 15-minute magic-link JWT for `email` and email it.

server/utils/mongoose.js

@@ -7,7 +7,7 @@ export const connectDB = async () => {
     return;
   }
 
-  const MONGODB_URI = process.env.NUXT_MONGODB_URI || process.env.MONGODB_URI || 'mongodb://localhost:27017/ghostguild';
+  const MONGODB_URI = useRuntimeConfig().mongodbUri;
 
   try {
     await mongoose.connect(MONGODB_URI, {

server/utils/payments.js

@@ -2,7 +2,7 @@ import { Resend } from 'resend'
 import Payment from '../models/payment.js'
 import { paymentConfirmationEmail } from '../emails/paymentConfirmation.js'
 
-const resend = new Resend(process.env.RESEND_API_KEY)
+const resend = new Resend(useRuntimeConfig().resendApiKey)
 
 function mapStatus(helcimStatus) {
   if (helcimStatus === 'paid') return 'success'

server/utils/resend.js

@@ -1,6 +1,6 @@
 import { Resend } from "resend";
 
-const resend = new Resend(process.env.RESEND_API_KEY);
+const resend = new Resend(useRuntimeConfig().resendApiKey);
 
 /**
  * Send event registration confirmation email