amadan
deploy: dev rebuild writes the Sign-in-with-Apple env into home.env (#1308)
Without it the /siwa/return trampoline 404s and the Apple door dies silently, as it did after today's rebuild.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+8
−0
deploy/ops-dev.sh+8 −0
diff --git a/deploy/ops-dev.sh b/deploy/ops-dev.sh| index 10210b4..6f4650b 100755 |
| --- a/deploy/ops-dev.sh |
| +++ b/deploy/ops-dev.sh |
| @@ -748,6 +748,14 @@ EOS |
| printf 'LCHAT_HOME_ORIGIN=https://home.dev.elevenmessenger.com\n' |
| printf 'LCHAT_CLOUD_REGIONS=[{"code":"ie","name":"Ireland","url":"https://cloud.ie.dev.11ch.at","token":"%s"},{"code":"fi","name":"Finland","url":"https://cloud.fi.dev.11ch.at","token":"%s"}]\n' "$ie_caller" "$fi_caller" |
| printf 'LCHAT_CLOUD_DEFAULT_REGION=ie\n' |
| + # Sign in with Apple: the audiences are committed facts (web Services ID + |
| + # iOS bundle id); the account-keying pepper is minted fresh — fine on a |
| + # rebuilt (empty) anchor DB, where there are no siwa anchors to orphan. |
| + # Without these the /siwa/return trampoline answers 404 and the Apple door |
| + # dies silently (2026-07-23). Google/Microsoft doors need OAuth secrets and |
| + # stay dark until set by hand. |
| + printf 'LCHAT_HOME_SIWA_CLIENT_IDS=com.elevenmessenger.signin,com.elevenmessenger.messenger\n' |
| + printf 'LCHAT_HOME_SIWA_PEPPER=%s\n' "$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')" |
| } | ssh_ie "ubuntu@$ip" 'sudo tee /data/home.env >/dev/null && sudo chmod 600 /data/home.env' |
| ssh_ie "ubuntu@$ip" 'sudo systemctl enable --now lchat-home' |
| # Service routes are local registry rows mesh-seed doesn't carry; re-adding |