From 698a2180aae1146873def64127cea32989e60cb3 Mon Sep 17 00:00:00 2001
From: Bastian Wagner <bastian.wagner@softconcis.de>
Date: Mon, 17 Aug 2026 16:42:57 +0200
Subject: [PATCH] chore: auto-load .env for local backend start/migrate scripts

---
 README.md            | 19 ++++++++++---------
 backend/package.json |  5 +++--
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index 4d105d6..382c1a7 100644
--- a/README.md
+++ b/README.md
@@ -23,21 +23,22 @@ pnpm dev:infra
 
 `pnpm dev:infra` starts local PostgreSQL/Redis (see `compose.dev.yml`); `pnpm dev:infra:down` stops them.
 
-Set the required OIDC env vars once per shell before running the backend. **`OIDC_CLIENT_SECRET` is a real secret — set it directly in your own shell, never commit it, never paste it into a shared/logged terminal.** `OIDC_AUDIENCE` should be set to the same value as `OIDC_CLIENT_ID` unless your IdP issues a distinct API audience.
+Create a **`.env` file at the repository root** (already gitignored, never committed) with the required values. `backend`'s `start:api`/`start:worker`/`migrate` scripts load it automatically via Node's `--env-file-if-exists` — no manual `export` needed. **`OIDC_CLIENT_SECRET` is a real secret — put it only in this local, gitignored file, never in `.env.example`, never pasted into a shared/logged terminal.** `OIDC_AUDIENCE` should be set to the same value as `OIDC_CLIENT_ID` unless your IdP issues a distinct API audience.
 
-```bash
-export DATABASE_URL=postgresql://travel_planner:travel_planner_dev@localhost:5432/travel_planner
-export REDIS_URL=redis://localhost:6379
-export OIDC_ISSUER=https://auth.forgecore.work
-export OIDC_CLIENT_ID=client_a297fd8d9c1f47a79d3600ea0c96984
-export OIDC_AUDIENCE=$OIDC_CLIENT_ID
-export OIDC_CLIENT_SECRET=<your-client-secret>   # never commit this value
+```dotenv
+DATABASE_URL=postgresql://travel_planner:travel_planner_dev@localhost:5432/travel_planner
+REDIS_URL=redis://localhost:6379
+OIDC_ISSUER=https://auth.forgecore.work
+OIDC_CLIENT_ID=client_a297fd8d9c1f47a79d3600ea0c96984
+OIDC_AUDIENCE=client_a297fd8d9c1f47a79d3600ea0c96984
+OIDC_CLIENT_SECRET=<your-client-secret>
 ```
 
 Run pending migrations against the dev database (first time only), then start the API and frontend:
 
 ```bash
-pnpm --filter backend build:api && node backend/dist/apps/api/src/migration.js
+pnpm --filter backend build:api
+pnpm --filter backend migrate
 pnpm --filter backend start:api
 pnpm --filter frontend start
 ```
diff --git a/backend/package.json b/backend/package.json
index 09df5ad..114e96f 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -13,8 +13,9 @@
     "start": "nest start api",
     "start:dev": "nest start api --watch",
     "start:debug": "nest start api --debug --watch",
-    "start:api": "node dist/apps/api/src/main.js",
-    "start:worker": "node dist/apps/worker/src/main.js",
+    "start:api": "node --env-file-if-exists=../.env dist/apps/api/src/main.js",
+    "start:worker": "node --env-file-if-exists=../.env dist/apps/worker/src/main.js",
+    "migrate": "node --env-file-if-exists=../.env dist/apps/api/src/migration.js",
     "lint": "eslint \"{apps,libs}/**/*.ts\" --fix",
     "test": "jest --runInBand",
     "test:watch": "jest --watch",