From d3597ee93cfc000664a57ae1f5e674356d32f1fc Mon Sep 17 00:00:00 2001
From: pucedoteth <119044801+pucedoteth@users.noreply.github.com>
Date: Thu, 27 Aug 2026 01:56:00 +0200
Subject: [PATCH] fix: don't report success when JWT secret generation fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The jwt-generator entrypoint ends in `|| exit 0`:

    [ ! -s /shared/jwtsecret.key ] && openssl rand -hex 32 | tr -d '\n' > /shared/jwtsecret.key || exit 0

The `||` is reached in two different situations: when the key already exists,
which is the intended no-op, and when the key was missing but generating it
failed. A full disk or an unwritable /shared both take the second path and the
container still exits 0:

    $ sh -c "[ ! -s ./ro/jwtsecret.key ] && openssl rand -hex 32 | tr -d '\n' > ./ro/jwtsecret.key || exit 0"
    sh: ./ro/jwtsecret.key: Permission denied
    exit code: 0
    key present: NO

service_completed_successfully is then satisfied, and both clients start against
an absent secret — the state the `-s` test was added to prevent, arrived at from
the other direction. reth and op-node fail on authrpc some seconds later, far
from the cause.

Generate into a temp file, check it is non-empty, and move it into place under
`set -e`, so a failed generation exits non-zero and never leaves a partial
secret where a reader could pick it up.

Behaviour is unchanged on every path that works today: an existing key is left
alone, a missing or empty one is (re)generated as 64 hex characters with no
trailing newline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 docker-compose.yaml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index 39c8b6e..4e8f959 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -2,8 +2,19 @@ services:
   jwt-generator:
     container_name: giwa-jwt-generator
     image: alpine/openssl
-    entrypoint: >
-      /bin/sh -c "[ ! -s /shared/jwtsecret.key ] && openssl rand -hex 32 | tr -d '\n' > /shared/jwtsecret.key || exit 0"
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        set -e
+        # Write to a temp file and check it before promoting: a failed openssl
+        # or a failed write must not leave an absent or empty secret behind,
+        # and must not report success to service_completed_successfully.
+        if [ ! -s /shared/jwtsecret.key ]; then
+          openssl rand -hex 32 | tr -d '\n' > /shared/jwtsecret.key.tmp
+          [ -s /shared/jwtsecret.key.tmp ]
+          mv /shared/jwtsecret.key.tmp /shared/jwtsecret.key
+        fi
     volumes:
       - shared:/shared
     restart: "no"