fix: split ambiguous AUTH_SECRET and remove dead Matrix routes

RESUME_AUTH_SECRET and FAMAPP_AUTH_SECRET now replace the bare AUTH_SECRET (previously defined 3x in .env, last-wins). Each is pinned to the value its container is already running, so re-applying recreated nothing. This fixes resume's app reading \\\, which was undefined and resolved to an empty string -- the next container recreate would have wiped all resume sessions. Caddyfile: removed matrix.ginnoir.com and the ginnoir.com apex .well-known/matrix block (no Synapse backend on :8008). Applied to valhalla: dc config resolves with no warnings, Caddy reloaded, dc up -d left every service up-to-date.

.env

@@ -38,9 +38,10 @@ POSTGRES_PASSWORD=postgres
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=minioadmin
 CHROME_TOKEN=chrome_token
-# IMPORTANT: Replace this before exposing resume.ginnoir.com publicly.
-# Generate with: openssl rand -hex 64
-AUTH_SECRET=CHANGE_ME_USE_openssl_rand_hex_64
+# Auth/JWT signing secret for Reactive Resume — the `app` service reads
+# ${RESUME_AUTH_SECRET}. Pinned to the value the running container already uses,
+# so recreating it does not invalidate sessions. Rotate with: openssl rand -hex 64
+RESUME_AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
 
 # =============================================================
 # FRESHRSS
@@ -49,8 +50,6 @@ FRESHRSS_API_PASSWORD=d0fet0th3x
 FRESHRSS_PASSWORD=d0fet0th3x
 FRESHRSS_EMAIL=3nigma.matt@gmail.com
 
-AUTH_SECRET=b4c032c8475cdd21e9138f2178c862f79cb6302ebf90e561cdea4cd6efcfe61e4ee03f5a4b3405c3c99239b734c8f387c6c3547d6c5b8f1c7d7db2b81c01ce0b
-
 # ── famapp ────────────────────────────────────────────────────────────────────
 FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
 FAMAPP_PULL_POLICY=always
@@ -62,7 +61,8 @@ FAMAPP_DB_USER=famapp
 FAMAPP_DB_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24
 FAMAPP_DB_NAME=famapp
 
-AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
+# famapp Auth.js session secret (compose maps this to the container's AUTH_SECRET)
+FAMAPP_AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
 
 # Fill in after Authentik bootstrap
 AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/

Caddyfile

@@ -194,21 +194,6 @@ minio.ginnoir.com {
 	reverse_proxy resume-minio:9001
 }
 
-# =============================================================
-# MATRIX — public
-# =============================================================
-ginnoir.com {
-	header /.well-known/matrix/* Content-Type application/json
-	header /.well-known/matrix/* Access-Control-Allow-Origin *
-	respond /.well-known/matrix/server `{"m.server": "matrix.ginnoir.com:443"}`
-	respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://matrix.ginnoir.com"},"m.identity_server":{"base_url":"https://identity.ginnoir.com"}}`
-}
-
-matrix.ginnoir.com {
-	reverse_proxy /_matrix/* localhost:8008
-	reverse_proxy /_synapse/client/* localhost:8008
-}
-
 # =============================================================
 # FAMAPP & AUTH — public
 # =============================================================

docker-compose.yml

@@ -619,7 +619,7 @@ services:
       NODE_ENV: production
       AUTH_URL: ${AUTH_URL}
       DATABASE_URL: postgres://${FAMAPP_DB_USER}:${FAMAPP_DB_PASSWORD}@famapp-db:5432/${FAMAPP_DB_NAME}
-      AUTH_SECRET: ${AUTH_SECRET}
+      AUTH_SECRET: ${FAMAPP_AUTH_SECRET}
       AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER}
       AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID}
       AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET}