The import-shots feature calls review.twotalesvfx.com from a server
action that reads process.env.SHOTS_API_KEY. That variable existed only
in the local gitignored .env, and the compose file passed just
DATABASE_URL, NEXTAUTH_SECRET and NEXTAUTH_URL to the app service. In
production the key was therefore undefined, so the action threw before
issuing any request -- and because Next.js masks server-action errors in
production, the UI showed a generic failure that looked like a network
or CDN problem rather than missing configuration.
Interpolate SHOTS_API_KEY from the deploy environment instead of
hardcoding it, so the secret stays out of the repo. The :? guard makes
compose abort with an explanatory message when the variable is missing,
rather than silently starting an app that cannot import shots.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
twotalesanimation