Backup/ARTEX
1
0
Fork 0
mirror of https://github.com/BaaRai/ARTEX.git synced 2026-11-13 11:40:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): keep the JWT signing key in a dedicated volume

Browse Source 
The server wrote jwt.key to the executable's directory, /app in the
image, so it lived in the container's writable layer and every container
rebuild generated a new key and signed all users out.

- ARTEX_JWT_KEY_DIR selects the key directory (default: config.BaseDir(),
  unchanged for non-Docker installs). docker-compose.yml sets it to
  /app/keys and bind-mounts ./keys there; the Dockerfile declares the
  volume. The key stays out of data/, which the file manager browses.
- loadOrCreateJWTKey creates the directory (0700). When keyDir/jwt.key is
  missing it migrates dataDir/jwt.key, then BaseDir()/jwt.key (mode 0600,
  old file removed), otherwise generates a new key. An existing key is
  never overwritten; a short one is now a startup error.
- .gitignore and .dockerignore exclude keys/.
- README and CHANGELOG updated; the 0.5.0 known issue is removed.
This commit is contained in:
BaaRai
2026-11-04 09:18:11 +01:00
parent fc35dddee8
commit 65bdc5d73c
11 changed files with 300 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/benchmark/README.md
+1 -1
View File
@@ -58,7 +58,7 @@ Standing rules, enforced by the runner:
cd scripts/benchmark
# against a locally deployed ARTEX, with an independent judge endpoint
ARTEX_TOKEN=<jwt or mint via ARTEX_JWT_KEY=/app/jwt.key copy> \
ARTEX_TOKEN=<jwt or mint via ARTEX_JWT_KEY=/app/keys/jwt.key copy> \
JUDGE_BASE_URL=https://api.example.com JUDGE_MODEL=<other-model> JUDGE_API_KEY=... \
python3 run_bench.py --corpus juice-shop --subject-model glm-5.3
```