Set Maptiler key at runtime instead of build time

.env.example

@@ -7,7 +7,7 @@ NEXTAUTH_URL=123
 NEXTAUTH_SECRET=123
 
 # Maptile configuration
-NEXT_PUBLIC_MAPTILER_STYLE_KEY=123
+MAPTILER_API_KEY=123
 
 # SEO
 PREVENT_SEARCH_BOTS=false

CHANGELOG.md

@@ -13,6 +13,9 @@ You can also check the
 
 - Features
   - Add SPARQL endpoints in the OpenTelemetry traces
+- Maintenance
+  - Set Maptiler API key from `MAPTILER_API_KEY` environment variable at
+    runtime, to avoid having to rebuild the application when the key is rotated
 
 ### 6.4.0 – 2026-03-13
 

Dockerfile

@@ -8,7 +8,6 @@ WORKDIR /usr/src/app
 #   --build-arg PREVENT_SEARCH_BOTS=<true/false> \
 #   --build-arg COMMIT=$(git rev-parse HEAD) \
 #   --build-arg VECTOR_TILE_URL=<url of the vector service> \
-#   --build-arg MAPTILER_STYLE_KEY=<maptiler style key> \
 #   --build-arg ADFS_ID=<adfs client id> \
 #   --build-arg ADFS_ISSUER=<adfs issuer> \
 #   --build-arg ADFS_PROFILE_URL=<adfs profile url> \
@@ -19,7 +18,6 @@ WORKDIR /usr/src/app
 ARG PREVENT_SEARCH_BOTS
 ARG COMMIT
 ARG VECTOR_TILE_URL
-ARG MAPTILER_STYLE_KEY
 ARG ADFS_ID
 ARG ADFS_ISSUER
 ARG ADFS_PROFILE_URL
@@ -40,7 +38,6 @@ ENV PORT=3000
 ENV PREVENT_SEARCH_BOTS=$PREVENT_SEARCH_BOTS
 ENV NEXT_PUBLIC_COMMIT=$COMMIT
 ENV NEXT_PUBLIC_BASE_VECTOR_TILE_URL=$VECTOR_TILE_URL
-ENV NEXT_PUBLIC_MAPTILER_STYLE_KEY=$MAPTILER_STYLE_KEY
 ENV ADFS_ID=$ADFS_ID
 ENV ADFS_ISSUER=$ADFS_ISSUER
 ENV ADFS_PROFILE_URL=$ADFS_PROFILE_URL

app/.env.development

@@ -3,7 +3,6 @@ ENDPOINT=sparql+https://cached.lindas.admin.ch/query
 SPARQL_GEO_ENDPOINT=https://geo.ld.admin.ch/query
 GRAPHQL_ENDPOINT=/api/graphql
 WHITELISTED_DATA_SOURCES=["Prod", "Prod-uncached", "Int", "Int-uncached", "Test", "Test-uncached", "LINDASold-Prod", "LINDASold-Prod-uncached", "LINDASold-Int", "LINDASold-Int-uncached", "LINDASold-Test", "LINDASold-Test-uncached"]
-NEXT_PUBLIC_VECTOR_TILE_URL=https://world.vectortiles.geo.admin.ch
-NEXT_PUBLIC_MAPTILER_STYLE_KEY=123
+MAPTILER_API_KEY=123
 ADFS_PROFILE_URL=https://www.myaccount-r.eiam.admin.ch/
 NEXTAUTH_URL=https://localhost:3000

app/charts/map/get-base-layer-style.ts

@@ -2,15 +2,15 @@ import merge from "lodash/merge";
 import { useMemo } from "react";
 import { MapboxStyle } from "react-map-gl";
 
-import { BASE_VECTOR_TILE_URL, MAPTILER_STYLE_KEY } from "@/domain/env";
+import { BASE_VECTOR_TILE_URL, MAPTILER_API_KEY } from "@/domain/env";
 
 import { Locale } from "../../locales/locales";
 
 import greyStyleBase from "./grey.json";
 import { hasLayout, mapLayers, replaceStyleTokens } from "./style-helpers";
 
 const tokens = {
-  "{key}": MAPTILER_STYLE_KEY,
+  "{key}": MAPTILER_API_KEY,
   "<BASE_VECTOR_TILE>": BASE_VECTOR_TILE_URL,
 };
 

app/domain/env.ts

@@ -48,6 +48,9 @@ export const GA_TRACKING_ID =
 export const ADFS_PROFILE_URL =
   clientEnv?.ADFS_PROFILE_URL ?? process.env.ADFS_PROFILE_URL;
 
+export const MAPTILER_API_KEY =
+  clientEnv?.MAPTILER_API_KEY ?? process.env.MAPTILER_API_KEY ?? "";
+
 /**
  * Server-side-only **RUNTIME** variables (not exposed through window)
  */
@@ -66,5 +69,3 @@ export const BUILD_GITHUB_REPO = (
 ).replace(/^git\+https/, "https"); // Don't use git+https for the link, need to check with Abraxas
 export const BASE_VECTOR_TILE_URL =
   process.env.NEXT_PUBLIC_BASE_VECTOR_TILE_URL ?? "";
-export const MAPTILER_STYLE_KEY =
-  process.env.NEXT_PUBLIC_MAPTILER_STYLE_KEY ?? "";

app/pages/api/client-env.ts

@@ -24,6 +24,7 @@ export default async function clientEnvApi(
           PUBLIC_URL: process.env.PUBLIC_URL,
           GRAPHQL_ENDPOINT: process.env.GRAPHQL_ENDPOINT,
           ADFS_PROFILE_URL: process.env.ADFS_PROFILE_URL,
+          MAPTILER_API_KEY: process.env.MAPTILER_API_KEY,
         })}`;
 
         if (result) {

scripts/docker-build-push.sh

@@ -19,7 +19,6 @@ docker build \
     --label "COMMIT=$CI_COMMIT_SHA" \
     --label "TAGS=$DOCKER_IMAGE_TAGS" \
     --build-arg COMMIT=$CI_COMMIT_SHA \
-    --build-arg MAPTILER_STYLE_KEY=$MAPTILER_STYLE_KEY \
     --build-arg VECTOR_TILE_URL=$VECTOR_TILE_URL \
     --build-arg ADFS_ID=$ADFS_ID \
     --build-arg ADFS_ISSUER=$ADFS_ISSUER \