From a3785a45cb68249075b9a773e83078c15deeb510 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Sat, 4 Jul 2026 16:05:56 +0200 Subject: [PATCH 1/2] =?UTF-8?q?fix(auth):=20login=20500=20=E2=80=94=20Data?= =?UTF-8?q?Protection=20key=20ring=20unreadable=20on=20root-owned=20keys?= =?UTF-8?q?=20volume?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Root cause: a 'keys' Docker volume created by an older root-running image is owned by root, but the container now runs as the non-root 'app' user (uid 1654). The API can't read/write its DataProtection key ring, so encrypting the OAuth correlation cookie fails and /api/v1/auth/login returns 500. (Staging was unaffected only because its volumes were recreated fresh during the pgvector swap.) Fixes: - compose: a one-shot 'init-keys' service (root busybox) chowns the keys volume to 1654:1654 before the api starts (depends_on service_completed_successfully). Auto-heals any pre-existing root-owned volume — local, staging, and future deployments. - Dockerfile: install libgssapi-krb5-2 — the slim aspnet:10.0 image dropped it and Npgsql logged 'Cannot load library libgssapi_krb5.so.2' on every connection. Verified on a clean local stack: 0 key-ring errors, 0 krb5 errors, login now 302. Co-Authored-By: Claude Opus 4.8 --- docker-compose.yml | 12 ++++++++++++ src/InboxIntel.Api/Dockerfile | 8 ++++++++ 2 files changed, 20 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index d1e7e0e..4deff9b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -53,6 +53,16 @@ services: postgres: condition: service_healthy + # One-shot: ensure the DataProtection 'keys' volume is owned by the API's non-root + # 'app' user (uid 1654). A volume created by an older root-running image is root-owned, + # which makes the app fail to read its key ring and 500s on login. Runs as root, chowns, + # exits; the api waits for it. Idempotent and cheap. + init-keys: + image: busybox + command: ["sh", "-c", "chown -R 1654:1654 /keys"] + volumes: + - keys:/keys + api: build: context: . @@ -79,6 +89,8 @@ services: depends_on: postgres: condition: service_healthy + init-keys: + condition: service_completed_successfully # V-08: bind to loopback so the API is not directly reachable from the network # (only via the frontend/nginx proxy over the internal compose network). This # prevents external clients from bypassing the proxy to spoof X-Forwarded-* headers. diff --git a/src/InboxIntel.Api/Dockerfile b/src/InboxIntel.Api/Dockerfile index a366fc2..5b80256 100644 --- a/src/InboxIntel.Api/Dockerfile +++ b/src/InboxIntel.Api/Dockerfile @@ -15,6 +15,14 @@ RUN dotnet publish src/InboxIntel.Api/InboxIntel.Api.csproj -c Release -o /app/p FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime WORKDIR /app + +# The slim aspnet:10.0 image dropped libgssapi_krb5, which Npgsql tries to load during +# connection negotiation ("Cannot load library libgssapi_krb5.so.2"). Harmless for password +# auth but noisy and a latent failure on some paths — install the Kerberos runtime lib. +RUN apt-get update \ + && apt-get install -y --no-install-recommends libgssapi-krb5-2 \ + && rm -rf /var/lib/apt/lists/* + COPY --from=build /app/publish . # V-12: run as the non-root 'app' user shipped in the .NET 8 images. Pre-create the -- 2.52.0 From 89ac20b124e29d14c1f6b2957cff6b9ba7d22386 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Sat, 4 Jul 2026 16:30:39 +0200 Subject: [PATCH 2/2] chore: strip UTF-8 BOM from generated files (format gate) --- .../Migrations/20260630140733_InitialCreate.Designer.cs | 2 +- .../Migrations/20260630200946_AddUserDigestFields.Designer.cs | 2 +- .../20260630201607_AddUnsubscribeConfidence.Designer.cs | 2 +- .../20260701192100_WeightSearchVectorSubjectBody.Designer.cs | 2 +- .../Migrations/20260701203001_EnablePgTrgm.Designer.cs | 2 +- .../20260701235112_TrigramIndexesSenderDomain.Designer.cs | 2 +- .../Migrations/20260702002304_AddEmbeddingColumn.Designer.cs | 2 +- .../20260702152850_FeatureFlagsAndUserSettings.Designer.cs | 2 +- .../Migrations/20260702152850_FeatureFlagsAndUserSettings.cs | 2 +- .../Migrations/AppDbContextModelSnapshot.cs | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs index fa742ee..f156b82 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260630140733_InitialCreate.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs index 1a812aa..364d091 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260630200946_AddUserDigestFields.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs index 036a720..884d818 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260630201607_AddUnsubscribeConfidence.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs index 34a37a1..c385932 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260701192100_WeightSearchVectorSubjectBody.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs index 846cc5e..b1a611b 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260701203001_EnablePgTrgm.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs index 81e5395..57989e9 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260701235112_TrigramIndexesSenderDomain.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs index 335c335..6ffacee 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260702002304_AddEmbeddingColumn.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs index a2d7e12..12ff438 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.Designer.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; diff --git a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs index 013fee7..4c5f040 100644 --- a/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs +++ b/src/InboxIntel.Infrastructure/Migrations/20260702152850_FeatureFlagsAndUserSettings.cs @@ -1,4 +1,4 @@ -using System; +using System; using Microsoft.EntityFrameworkCore.Migrations; #nullable disable diff --git a/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs b/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs index c0bb4e9..549e9dd 100644 --- a/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs +++ b/src/InboxIntel.Infrastructure/Migrations/AppDbContextModelSnapshot.cs @@ -1,4 +1,4 @@ -// +// using System; using InboxIntel.Infrastructure.Persistence; using Microsoft.EntityFrameworkCore; -- 2.52.0