fix(auth): login 500 — DataProtection key ring on root-owned volume #37

Merged

cesnimda merged 2 commits from fix/login-keyring-500 into develop 2026-07-04 16:52:56 +02:00

Conversation 0 Commits 2 Files Changed 12

+30 -10

cesnimda commented 2026-07-04 16:05:58 +02:00

Owner

Copy Link

Copy Source

Root cause + fix for the login 500: root-owned keys volume vs non-root app user. Adds an init-keys chown one-shot + libgssapi-krb5-2. Verified: login now 302 on a clean local stack.

🤖 Generated with Claude Code

Root cause + fix for the login 500: root-owned keys volume vs non-root app user. Adds an init-keys chown one-shot + libgssapi-krb5-2. Verified: login now 302 on a clean local stack. 🤖 Generated with Claude Code

cesnimda added 1 commit 2026-07-04 16:05:59 +02:00

fix(auth): login 500 — DataProtection key ring unreadable on root-owned keys volume ... a3785a45cb

Root cause: a 'keys' Docker volume created by an older root-running image is owned
by root, but the container now runs as the non-root 'app' user (uid 1654). The API
can't read/write its DataProtection key ring, so encrypting the OAuth correlation
cookie fails and /api/v1/auth/login returns 500. (Staging was unaffected only because
its volumes were recreated fresh during the pgvector swap.)

Fixes:
- compose: a one-shot 'init-keys' service (root busybox) chowns the keys volume to
  1654:1654 before the api starts (depends_on service_completed_successfully). Auto-heals
  any pre-existing root-owned volume — local, staging, and future deployments.
- Dockerfile: install libgssapi-krb5-2 — the slim aspnet:10.0 image dropped it and
  Npgsql logged 'Cannot load library libgssapi_krb5.so.2' on every connection.

Verified on a clean local stack: 0 key-ring errors, 0 krb5 errors, login now 302.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cesnimda added 1 commit 2026-07-04 16:30:42 +02:00

chore: strip UTF-8 BOM from generated files (format gate) 89ac20b124

cesnimda merged commit 04ff72097b into develop 2026-07-04 16:52:56 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

cesnimda

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cesnimda/Inboxintel#37