From 8b135a321a7636d68a6b3bbeb955d0e835ba6094 Mon Sep 17 00:00:00 2001
From: CaffeineFueled <hello@uphillsecurity.com>
Date: Fri, 21 Aug 2026 07:08:27 +0200
Subject: [PATCH] infra: CHANGE some cleanup regarding the .env process with
 container

---
 .env.example |  7 +++++--
 README.md    | 19 ++++++++++++++++++-
 build.sh     | 29 ++++++++++++++++++++---------
 3 files changed, 43 insertions(+), 12 deletions(-)

diff --git a/.env.example b/.env.example
index e8e00a6..a44283e 100644
--- a/.env.example
+++ b/.env.example
@@ -6,12 +6,15 @@
 # nothing. .env is read from the working directory and is gitignored.
 #
 # Precedence: command line flags > environment > .env > these defaults.
-# This file is sourced by build.sh, so shell syntax applies.
+#
+# Plain KEY=VALUE only. Do NOT quote values: this file is also usable as
+# `podman run --env-file .env`, which would treat quotes as part of the value.
+# Spaces are fine unquoted, e.g. GALLERY_TITLE=Holiday 2026
 
 # Page title. Used for both <title> and the <h1> header.
 # Special characters are HTML-escaped automatically.
 # Flag: --title=TEXT
-GALLERY_TITLE="Gallery"
+GALLERY_TITLE=Gallery
 
 # Show the "Powered by shellery" footer.  1 = show, 0 = hide.
 # Flag: --no-footer
diff --git a/README.md b/README.md
index ad01fcf..a3bd2f5 100644
--- a/README.md
+++ b/README.md
@@ -52,6 +52,14 @@ mkdir -p images output
 podman run -v $(pwd)/images:/app/images -v $(pwd)/output:/app/output git.uphillsecurity.com/cf7/shellery:latest
 ```
 
+With a config file, add `--env-file .env`:
+
+```bash
+cp .env.example .env    # edit to taste
+
+podman run --env-file .env -v $(pwd)/images:/app/images -v $(pwd)/output:/app/output git.uphillsecurity.com/cf7/shellery:latest
+```
+
 ### Local
 
 - Clone
@@ -84,6 +92,10 @@ cp .env.example .env
 `-e` value passed to the container still wins over the file. Point `ENV_FILE` at another
 path to use a different file.
 
+Use plain `KEY=VALUE` and **do not quote values**. The file is parsed, not sourced, so the
+same file works both locally and with `podman run --env-file`, which would otherwise treat
+quotes as part of the value. Spaces need no quoting: `GALLERY_TITLE=Holiday 2026`.
+
 | Variable | Flag | Default | Effect |
 |---|---|---|---|
 | `GALLERY_TITLE` | `--title=TEXT` | `Gallery` | Page `<title>` and the `<h1>` header |
@@ -101,7 +113,12 @@ podman run -e GALLERY_TITLE="Holiday 2026" -e SHOW_FOOTER=0 \
   -v $(pwd)/images:/app/images -v $(pwd)/output:/app/output \
   git.uphillsecurity.com/cf7/shellery:latest
 
-# container, via a mounted .env
+# container, via --env-file
+podman run --env-file .env \
+  -v $(pwd)/images:/app/images -v $(pwd)/output:/app/output \
+  git.uphillsecurity.com/cf7/shellery:latest
+
+# container, mounting the file instead (equivalent)
 podman run -v $(pwd)/.env:/app/.env:ro \
   -v $(pwd)/images:/app/images -v $(pwd)/output:/app/output \
   git.uphillsecurity.com/cf7/shellery:latest
diff --git a/build.sh b/build.sh
index 0c3303b..7042c3a 100755
--- a/build.sh
+++ b/build.sh
@@ -11,17 +11,28 @@ TEMPLATES_DIR="templates"
 ASSETS_DIR="assets"
 
 # Load .env if present; see .env.example for every option and its default.
-# Precedence: command line flags > environment > .env > built-in defaults.
+# Parsed as plain KEY=VALUE (not sourced), so the same file also works with
+# `podman run --env-file`. Values already in the environment are left alone,
+# which gives: flags > environment > .env > built-in defaults.
 ENV_FILE="${ENV_FILE:-.env}"
 if [[ -f "$ENV_FILE" ]]; then
-    # Remember caller-supplied values so the file cannot clobber them
-    env_override=$(export -p | grep -E '^declare -x (STRIP_EXIF|GALLERY_TITLE|SHOW_FOOTER)=' || true)
-    # shellcheck source=/dev/null
-    source "$ENV_FILE"
-    if [[ -n "$env_override" ]]; then
-        eval "$env_override"
-    fi
-    unset env_override
+    while IFS= read -r env_line || [[ -n "$env_line" ]]; do
+        env_line="${env_line%$'\r'}"                       # tolerate CRLF
+        env_line="${env_line#"${env_line%%[![:space:]]*}"}" # trim leading space
+        [[ -z "$env_line" || "$env_line" == \#* ]] && continue
+        [[ "$env_line" == *=* ]] || continue
+        env_key="${env_line%%=*}"
+        env_val="${env_line#*=}"
+        env_key="${env_key%"${env_key##*[![:space:]]}"}"    # trim trailing space
+        [[ "$env_key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+        # Strip one layer of matching quotes (omit them for --env-file compatibility)
+        if [[ ${#env_val} -ge 2 && ( "$env_val" == \"*\" || "$env_val" == \'*\' ) ]]; then
+            env_val="${env_val:1:${#env_val}-2}"
+        fi
+        # Anything already set (environment, or earlier in this script) wins
+        [[ -n "${!env_key+x}" ]] || printf -v "$env_key" '%s' "$env_val"
+    done < "$ENV_FILE"
+    unset env_line env_key env_val
 fi
 
 # Image metadata (EXIF/GPS/IPTC/XMP) is stripped by default.