From ee61007939797c91946902575e8030e15601d1fe Mon Sep 17 00:00:00 2001
From: Alex Blank <alexblank@fastmail.com>
Date: Mon, 4 May 2026 15:39:07 +0200
Subject: [PATCH] deployment fixes

---
 docker-compose.yml   | 14 ++++++++++++--
 docs/REQUIREMENTS.md |  1 +
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index e0c45db..5cd6ba5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,13 +3,17 @@ services:
     build:
       context: .
       dockerfile: backend/Dockerfile
+    env_file:
+      - .env
     environment:
       AUTH_ENABLED: "true"
       SSH_KEY_DIRECTORY: /root/.ssh
-      SSH_KEY_NAME: ${SSH_KEY_NAME}
+      SSH_KEY_NAME: ${SSH_KEY_NAME:-id_ed25519}
     volumes:
-      - ${SSH_KEY_DIRECTORY}:/root/.ssh:ro
+      - ${SSH_KEY_DIRECTORY:-./secrets/ssh}:/root/.ssh:ro
     restart: unless-stopped
+    networks:
+      - web
     expose:
       - "8000"
     labels:
@@ -48,6 +52,8 @@ services:
     depends_on:
       backend:
         condition: service_healthy
+    networks:
+      - web
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.${FRONTEND_APP_NAME}.rule=Host(`${FRONTEND_APP_HOST}`)"
@@ -57,3 +63,7 @@ services:
     ports:
       - "8080:80"
     restart: unless-stopped
+
+networks:
+  web:
+    external: true
diff --git a/docs/REQUIREMENTS.md b/docs/REQUIREMENTS.md
index e563989..a4f6490 100644
--- a/docs/REQUIREMENTS.md
+++ b/docs/REQUIREMENTS.md
@@ -127,6 +127,7 @@ Phase 1: Jellyfin media index, SSH-based remote filesystem inspection, server mo
 - Support OIDC login in the frontend using an OIDC client library, with backend JWT validation for protected API requests.
 - Provide Docker Compose deployment files at the repository root for production and local development.
 - Backend Docker deployment should mount a private SSH key and a known_hosts file into the container rather than baking them into the image.
+- Production compose should also pass the root `.env` into the backend container so runtime auth settings like `OIDC_ISSUER_URL` are available there, not just at compose interpolation time.
 - The SSH key configuration should support separate directory/name inputs so Docker Compose can mount an entire `./secrets/ssh` directory into `/root/.ssh` while the app assembles the full key path.
 - Show Jellyfin media counts for movies, series, and series episodes on the dashboard.
 - Show dashboard session activity from Jellyfin, including both currently playing sessions and logged-in idle sessions.