From e8413343164662baabfff2efe52e6665e1512afe Mon Sep 17 00:00:00 2001 From: ginnoir Date: Tue, 2 Jun 2026 22:33:59 -0500 Subject: [PATCH] fix: split ambiguous AUTH_SECRET and remove dead Matrix routes RESUME_AUTH_SECRET and FAMAPP_AUTH_SECRET now replace the bare AUTH_SECRET (previously defined 3x in .env, last-wins). Each is pinned to the value its container is already running, so re-applying recreated nothing. This fixes resume's app reading \\\, which was undefined and resolved to an empty string -- the next container recreate would have wiped all resume sessions. Caddyfile: removed matrix.ginnoir.com and the ginnoir.com apex .well-known/matrix block (no Synapse backend on :8008). Applied to valhalla: dc config resolves with no warnings, Caddy reloaded, dc up -d left every service up-to-date. --- .env | 12 ++++++------ Caddyfile | 15 --------------- docker-compose.yml | 2 +- 3 files changed, 7 insertions(+), 22 deletions(-) diff --git a/.env b/.env index 307177e..d379432 100644 --- a/.env +++ b/.env @@ -38,9 +38,10 @@ POSTGRES_PASSWORD=postgres MINIO_ROOT_USER=minioadmin MINIO_ROOT_PASSWORD=minioadmin CHROME_TOKEN=chrome_token -# IMPORTANT: Replace this before exposing resume.ginnoir.com publicly. -# Generate with: openssl rand -hex 64 -AUTH_SECRET=CHANGE_ME_USE_openssl_rand_hex_64 +# Auth/JWT signing secret for Reactive Resume — the `app` service reads +# ${RESUME_AUTH_SECRET}. Pinned to the value the running container already uses, +# so recreating it does not invalidate sessions. Rotate with: openssl rand -hex 64 +RESUME_AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f # ============================================================= # FRESHRSS @@ -49,8 +50,6 @@ FRESHRSS_API_PASSWORD=d0fet0th3x FRESHRSS_PASSWORD=d0fet0th3x FRESHRSS_EMAIL=3nigma.matt@gmail.com -AUTH_SECRET=b4c032c8475cdd21e9138f2178c862f79cb6302ebf90e561cdea4cd6efcfe61e4ee03f5a4b3405c3c99239b734c8f387c6c3547d6c5b8f1c7d7db2b81c01ce0b - # ── famapp ──────────────────────────────────────────────────────────────────── FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest FAMAPP_PULL_POLICY=always @@ -62,7 +61,8 @@ FAMAPP_DB_USER=famapp FAMAPP_DB_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24 FAMAPP_DB_NAME=famapp -AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI= +# famapp Auth.js session secret (compose maps this to the container's AUTH_SECRET) +FAMAPP_AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI= # Fill in after Authentik bootstrap AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/ diff --git a/Caddyfile b/Caddyfile index 950209f..e982a8f 100644 --- a/Caddyfile +++ b/Caddyfile @@ -194,21 +194,6 @@ minio.ginnoir.com { reverse_proxy resume-minio:9001 } -# ============================================================= -# MATRIX — public -# ============================================================= -ginnoir.com { - header /.well-known/matrix/* Content-Type application/json - header /.well-known/matrix/* Access-Control-Allow-Origin * - respond /.well-known/matrix/server `{"m.server": "matrix.ginnoir.com:443"}` - respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://matrix.ginnoir.com"},"m.identity_server":{"base_url":"https://identity.ginnoir.com"}}` -} - -matrix.ginnoir.com { - reverse_proxy /_matrix/* localhost:8008 - reverse_proxy /_synapse/client/* localhost:8008 -} - # ============================================================= # FAMAPP & AUTH — public # ============================================================= diff --git a/docker-compose.yml b/docker-compose.yml index 8802a04..6ca0b76 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -619,7 +619,7 @@ services: NODE_ENV: production AUTH_URL: ${AUTH_URL} DATABASE_URL: postgres://${FAMAPP_DB_USER}:${FAMAPP_DB_PASSWORD}@famapp-db:5432/${FAMAPP_DB_NAME} - AUTH_SECRET: ${AUTH_SECRET} + AUTH_SECRET: ${FAMAPP_AUTH_SECRET} AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER} AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID} AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET}