From c045922c5ba99557e6a2c3c174e07cc614031e57 Mon Sep 17 00:00:00 2001
From: Frank van den Berg <f.vandenberg@calderholding.nl>
Date: Sun, 28 Jun 2026 23:24:09 +0200
Subject: [PATCH] Fix Mercure JWT secret mismatch

setup.sh was forcing --env-file ../.env (root .env with placeholder secret)
instead of letting Docker Compose use docker/.env (real secret). Mercure
config now generates the publisher JWT from MERCURE_JWT_SECRET directly,
removing the need for a separate pre-generated token.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 config/packages/mercure.yaml | 3 ++-
 docker/setup.sh              | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/packages/mercure.yaml b/config/packages/mercure.yaml
index a0ce965..a4c87b7 100644
--- a/config/packages/mercure.yaml
+++ b/config/packages/mercure.yaml
@@ -4,4 +4,5 @@ mercure:
             url: '%env(MERCURE_URL)%'
             public_url: '%env(MERCURE_PUBLIC_URL)%'
             jwt:
-                value: '%env(MERCURE_PUBLISHER_JWT_TOKEN)%'
+                secret: '%env(MERCURE_JWT_SECRET)%'
+                publish: ['*']
diff --git a/docker/setup.sh b/docker/setup.sh
index c5c3179..5b9a91d 100644
--- a/docker/setup.sh
+++ b/docker/setup.sh
@@ -28,7 +28,7 @@ else
 fi
 
 # Helper to run docker compose from the docker directory
-dc() { (cd "$DOCKER_DIR" && $DOCKER_COMPOSE -f compose.yaml -f compose.override.yaml --env-file ../.env "$@"); }
+dc() { (cd "$DOCKER_DIR" && $DOCKER_COMPOSE -f compose.yaml -f compose.override.yaml "$@"); }
 
 REBUILD=1
 RECREATE=0