deployment fixes

docker-compose.yml

@@ -3,13 +3,17 @@ services:
     build:
       context: .
       dockerfile: backend/Dockerfile
+    env_file:
+      - .env
     environment:
       AUTH_ENABLED: "true"
       SSH_KEY_DIRECTORY: /root/.ssh
-      SSH_KEY_NAME: ${SSH_KEY_NAME}
+      SSH_KEY_NAME: ${SSH_KEY_NAME:-id_ed25519}
     volumes:
-      - ${SSH_KEY_DIRECTORY}:/root/.ssh:ro
+      - ${SSH_KEY_DIRECTORY:-./secrets/ssh}:/root/.ssh:ro
     restart: unless-stopped
+    networks:
+      - web
     expose:
       - "8000"
     labels:
@@ -48,6 +52,8 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    networks:
+      - web
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.${FRONTEND_APP_NAME}.rule=Host(`${FRONTEND_APP_HOST}`)"
@@ -57,3 +63,7 @@ services:
     ports:
       - "8080:80"
     restart: unless-stopped
+
+networks:
+  web:
+    external: true

docs/REQUIREMENTS.md

@@ -127,6 +127,7 @@ Phase 1: Jellyfin media index, SSH-based remote filesystem inspection, server mo
 - Support OIDC login in the frontend using an OIDC client library, with backend JWT validation for protected API requests.
 - Provide Docker Compose deployment files at the repository root for production and local development.
 - Backend Docker deployment should mount a private SSH key and a known_hosts file into the container rather than baking them into the image.
+- Production compose should also pass the root `.env` into the backend container so runtime auth settings like `OIDC_ISSUER_URL` are available there, not just at compose interpolation time.
 - The SSH key configuration should support separate directory/name inputs so Docker Compose can mount an entire `./secrets/ssh` directory into `/root/.ssh` while the app assembles the full key path.
 - Show Jellyfin media counts for movies, series, and series episodes on the dashboard.
 - Show dashboard session activity from Jellyfin, including both currently playing sessions and logged-in idle sessions.