ginnoir
51acb44322
Deploy to valhalla / deploy (push) Has been cancelled
Add Recyclarr to the media stack, pin database/object-store/Caddy/Vault images with Watchtower disabled, expose JDownloader at jd.ginnoir.com, and restrict minio/homarr/docs to internal_only. Mark TB-002–004 and TB-033 complete; bundle batch-3 OIDC env for FreshRSS, ownCloud, and Reactive Resume.
15 lines
631 B
Bash
15 lines
631 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Restored resume DB may contain JWKS encrypted with an old AUTH_SECRET.
|
|
# Better Auth then fails session verification after OAuth (login page loop).
|
|
# Safe fix: drop JWKS + sessions; app regenerates keys on next start.
|
|
|
|
echo "=== resume: reset Better Auth JWKS (fixes session decrypt errors) ==="
|
|
docker stop resume >/dev/null
|
|
docker exec postgres_resume psql -U postgres -d postgres -c "TRUNCATE jwks, session, oauth_access_token, oauth_refresh_token CASCADE;"
|
|
docker start resume >/dev/null
|
|
sleep 15
|
|
docker logs resume --tail 15 2>&1
|
|
echo "done — retry resume.ginnoir.com → Authentik"
|