From e1fa1197f473110be2cf72a64928b957db4123f1 Mon Sep 17 00:00:00 2001
From: jknapp <jknapp85@gmail.com>
Date: Fri, 15 May 2026 08:38:05 -0700
Subject: [PATCH] fix(compose): pass CLI_TOKEN_SECRET through to the app
 service

The explicit `environment:` map in compose filters which .env vars reach
the container. Adding CLI_TOKEN_SECRET so the new CLI-token verifier can
read it at runtime.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 docker-compose.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 02e804a..3a08f36 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -92,6 +92,7 @@ services:
       EMBEDDING_DIM: ${EMBEDDING_DIM:-384}
 
       NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?required}
+      CLI_TOKEN_SECRET: ${CLI_TOKEN_SECRET:?required}
     ports:
       # Exposed to the host so an external reverse proxy (HAProxy, nginx,
       # etc.) can reach the app. When using the `tls` profile, Caddy also