Copy .env into the image - it was never reaching the container

The configuration was committed but excluded twice over: .dockerignore listed
.env, and the Dockerfile's explicit COPY lines never mentioned it. So the image
built cleanly, the container started with no configuration at all, and exited on
the first required setting - the same RuntimeError and the same Bad Gateway that
committing .env was meant to fix.

Silent in both directions. The build log shows every COPY succeeding, and the
platform reports only a 502, because the process is gone before it can say
anything. Nothing about "build completed" hints that the container has no
configuration.

Verified by reconstructing the image filesystem from the Dockerfile's COPY
lines with .dockerignore applied, then booting from it with an empty
environment: /app/.env is present, SIGNIN_PASSWORDS.txt is not, and /, /docs and
/api/health all answer 200. That reconstruction is the check the earlier "boots
from .env alone" testing was missing - it ran on the host, where .env sits next
to app/ whether the image would have contained it or not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -3,6 +3,14 @@ __pycache__
 *.pyc
 .pytest_cache
 *.log
-.env
 .git
 tests
+
+# .env is deliberately NOT ignored - it carries this deployment's configuration
+# and the Dockerfile copies it into the image. Excluding it here silently undid
+# that: the build succeeded, the container started with no configuration at all,
+# and died on the first required setting.
+#
+# The generated sign-in passwords must never be in the image.
+SIGNIN_PASSWORDS.txt
+.env.local

Dockerfile

@@ -46,6 +46,19 @@ COPY scripts ./scripts
 COPY data ./data
 COPY serve.py .
 
+# The deployment's configuration. settings.py loads it from the backend root -
+# app/infrastructure/settings.py resolves parents[2], which is /app here - so it
+# has to land next to app/, not inside it.
+#
+# Easy to leave out, and silent when you do: the image builds, the container
+# starts with no configuration, and exits on the first required setting with the
+# platform reporting only a Bad Gateway. .dockerignore must not exclude it
+# either; that alone is enough to reproduce the same failure.
+#
+# Real environment variables still win over this file (load_dotenv is called
+# without override=True), so Dokploy can override any value without a rebuild.
+COPY .env .
+
 # Pristine copies of everything the app also WRITES to, kept at a path that is
 # never mounted over.
 #