From 8f32d90d2819348220ce3589e238c04ea1458a6a Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Mon, 29 Jun 2026 15:56:39 +0200 Subject: [PATCH] fix(compose): pass BACKUP_KEY through to the server container MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The server's compose environment: block is an allowlist — it only forwards the vars it names. BACKUP_KEY was never added when the backup feature landed, so even though Komodo wrote BACKUP_KEY into the Stack .env, compose dropped it and the container came up without it (docker inspect showed JWT/SIGN present, BACKUP_KEY absent — not empty, absent). The Backup screen correctly reported 'BACKUP_KEY missing'. Add BACKUP_KEY: ${BACKUP_KEY:-} next to EVENT_SIGNING_KEY (optional, empty default — backups stay off until it's set). The prod overlay only merges VISION_URL, so the base addition flows through to prod. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V --- docker-compose.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 17ae275..a6d35ee 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -24,6 +24,10 @@ services: # Dedicated ledger-signing key. Falls back to JWT_SECRET (with a warning) if empty; # set a distinct one in prod. See apps/server/.env.example + local-jwt-auth. EVENT_SIGNING_KEY: ${EVENT_SIGNING_KEY:-} + # Dedicated backup-ENCRYPTION key (separate from the signing key). Empty = backups stay + # off (the in-UI target + retention do nothing without it). Per-booth + unique; escrow it + # offsite. See apps/server/.env.example + wiki/concepts/backup-recovery.md. + BACKUP_KEY: ${BACKUP_KEY:-} # CRITICAL on the plain-HTTP booth LAN: cookies are Secure (HTTPS-only) by DEFAULT, # so without COOKIE_SECURE=0 the auth cookie is never sent over http and operators # CANNOT LOG IN. Leave unset only behind TLS. See disk-os-hardening "deploy-time runbook".