install.sh never generates TRITON_MANAGE_JWT_SIGNING_KEY — fresh installs crash-loop #15

New issue

Closed

opened 2026-08-13 07:08:53 +02:00 by amiryahaya · 0 comments

amiryahaya commented

2026-08-13 07:08:53 +02:00

Owner

Summary

Fresh manage-server installs crash-loop on first boot with:

manage server error: TRITON_MANAGE_JWT_SIGNING_KEY is required (hex-encoded HS256 secret; min 32 bytes after decode)

Root cause (two separate bugs)

manage-server/env.template / install.sh never generate a JWT signing key.
install.sh generates TRITON_VAULT_KEY (openssl rand -hex 32) and TRITON_MANAGE_WORKER_KEY (openssl rand -hex 16), but there is no equivalent step for TRITON_MANAGE_JWT_SIGNING_KEY, and it isn't even present as a placeholder in env.template.
manage-server/compose.yaml doesn't pass the var through even if you set it manually.
The manage-server.environment block explicitly whitelists every variable forwarded into the container. TRITON_MANAGE_JWT_SIGNING_KEY is missing from that list, so even after adding it to .env by hand, the container still doesn't see it until the var is also added to compose.yaml.

Repro

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh \
  | sudo bash -s -- --no-tls --gateway-hostname <your-host>

Containers come up, manage-server crash-loops indefinitely, health check on :8082 times out.

Workaround used

JWT_KEY=$(openssl rand -hex 32)
echo "TRITON_MANAGE_JWT_SIGNING_KEY=${JWT_KEY}" >> .env

...and add TRITON_MANAGE_JWT_SIGNING_KEY: ${TRITON_MANAGE_JWT_SIGNING_KEY} to compose.yaml's manage-server.environment block, then docker compose up -d --force-recreate manage-server.

Fix

PR incoming: generate the key in install.sh alongside the vault/worker keys, add the placeholder to env.template, and add the var to compose.yaml's environment whitelist.

## Summary Fresh `manage-server` installs crash-loop on first boot with: ``` manage server error: TRITON_MANAGE_JWT_SIGNING_KEY is required (hex-encoded HS256 secret; min 32 bytes after decode) ``` ## Root cause (two separate bugs) 1. **`manage-server/env.template` / `install.sh` never generate a JWT signing key.** `install.sh` generates `TRITON_VAULT_KEY` (`openssl rand -hex 32`) and `TRITON_MANAGE_WORKER_KEY` (`openssl rand -hex 16`), but there is no equivalent step for `TRITON_MANAGE_JWT_SIGNING_KEY`, and it isn't even present as a placeholder in `env.template`. 2. **`manage-server/compose.yaml` doesn't pass the var through even if you set it manually.** The `manage-server.environment` block explicitly whitelists every variable forwarded into the container. `TRITON_MANAGE_JWT_SIGNING_KEY` is missing from that list, so even after adding it to `.env` by hand, the container still doesn't see it until the var is also added to `compose.yaml`. ## Repro ``` curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh \ | sudo bash -s -- --no-tls --gateway-hostname <your-host> ``` Containers come up, `manage-server` crash-loops indefinitely, health check on `:8082` times out. ## Workaround used ``` JWT_KEY=$(openssl rand -hex 32) echo "TRITON_MANAGE_JWT_SIGNING_KEY=${JWT_KEY}" >> .env ``` ...and add `TRITON_MANAGE_JWT_SIGNING_KEY: ${TRITON_MANAGE_JWT_SIGNING_KEY}` to `compose.yaml`'s `manage-server.environment` block, then `docker compose up -d --force-recreate manage-server`. ## Fix PR incoming: generate the key in `install.sh` alongside the vault/worker keys, add the placeholder to `env.template`, and add the var to `compose.yaml`'s environment whitelist.

amiryahaya referenced this issue from a commit

2026-08-13 07:10:02 +02:00

Fix manage-server crash-loop: generate and pass through TRITON_MANAGE_JWT_SIGNING_KEY

amiryahaya referenced this issue from a pull request that will close it,

2026-08-13 07:10:08 +02:00

Fix manage-server crash-loop: generate and pass through TRITON_MANAGE_JWT_SIGNING_KEY #16

amiryahaya closed this issue

2026-08-13 07:53:08 +02:00