From 804cf90954b88af210a00f9ac03344d36620247c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vi=CC=81ctor=20Falco=CC=81n?= Date: Fri, 17 Jul 2026 21:08:46 +0200 Subject: [PATCH] fix(mcp): keep Passport signing keys at 600 in production MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The entrypoint's recursive `chmod -R 775 /app/storage` widened the generated oauth-private.key/oauth-public.key to 775, which league/oauth2-server rejects (it wants 600/660) — logging a warning on every /oauth/authorize and /mcp/oauth request. Re-tighten the keys to 600 after the storage chmod. Runs every boot, so it also fixes keys left at 775 on a persisted volume. --- docker/entrypoint.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 25f234c6..0276898b 100644 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -109,6 +109,13 @@ chown -R www-data:www-data /app/storage /app/bootstrap/cache chmod -R 775 /app/storage /app/bootstrap/cache chmod 664 /app/storage/logs/laravel.log +# Passport signing keys must stay private: the recursive chmod above widens them +# to 775, but league/oauth2-server rejects any mode other than 600/660 and logs a +# warning on every /oauth/authorize and /mcp/oauth request. Lock them back down. +if [ -f /app/storage/oauth-private.key ]; then + chmod 600 /app/storage/oauth-private.key /app/storage/oauth-public.key +fi + echo "=== Startup complete, launching services ===" # Start supervisor