BaaRai 65bdc5d73c fix(auth): keep the JWT signing key in a dedicated volume ...

The server wrote jwt.key to the executable's directory, /app in the
image, so it lived in the container's writable layer and every container
rebuild generated a new key and signed all users out.

- ARTEX_JWT_KEY_DIR selects the key directory (default: config.BaseDir(),
  unchanged for non-Docker installs). docker-compose.yml sets it to
  /app/keys and bind-mounts ./keys there; the Dockerfile declares the
  volume. The key stays out of data/, which the file manager browses.
- loadOrCreateJWTKey creates the directory (0700). When keyDir/jwt.key is
  missing it migrates dataDir/jwt.key, then BaseDir()/jwt.key (mode 0600,
  old file removed), otherwise generates a new key. An existing key is
  never overwritten; a short one is now a startup error.
- .gitignore and .dockerignore exclude keys/.
- README and CHANGELOG updated; the 0.5.0 known issue is removed.

2026-11-04 09:18:11 +01:00

..

main_test.go

fix(security): scrub startup secrets before any child can spawn

2026-11-03 22:14:35 +01:00

main.go

fix(auth): keep the JWT signing key in a dedicated volume

2026-11-04 09:18:11 +01:00