fix(manage-server): remove dead TRITON_MANAGE_JWT_SIGNING_KEY generation/passthrough #23

Merged

amiryahaya merged 1 commit from fix/861-remove-dead-jwt-signing-key into main

2026-08-22 16:07:00 +02:00

amiryahaya commented

2026-08-22 14:16:08 +02:00

Owner

Summary

Issue #600 on triton (closed 2026-08-07) migrated manage-server admin sessions from JWT-in-localStorage to httpOnly cookies + bcrypt. The source-of-truth scripts/deploy/manage-server/ in that repo correctly dropped TRITON_MANAGE_JWT_SIGNING_KEY at the time, but that cleanup was never synced to this distribution repo.

Removes the now-dead variable from:

manage-server/install.sh / install.ps1 — stop generating and templating the key
manage-server/env.template — drop the Sessions/auth (auto-generated) block
manage-server/compose.yaml — stop passing it into the container (the binary never reads it)
manage-server/upgrade.sh / upgrade.ps1 — drop the backfill block (also removes upgrade.ps1's now-unused New-RandomHex helper)

Bumped SCRIPT_VERSION in install.sh and upgrade.sh (the two files that track it).

Audited the rest of the repo for other #600-era JWT-auth references — none found; manage-server/ was the only place carrying them.

Test plan

bash -n on install.sh and upgrade.sh
PowerShell AST parse on install.ps1 and upgrade.ps1
grep -rn JWT manage-server/ returns no matches
Diffed against triton repo's scripts/deploy/manage-server/ to confirm the target shape matches

Ref: triton#861

## Summary Issue #600 on `triton` (closed 2026-08-07) migrated manage-server admin sessions from JWT-in-localStorage to httpOnly cookies + bcrypt. The source-of-truth `scripts/deploy/manage-server/` in that repo correctly dropped `TRITON_MANAGE_JWT_SIGNING_KEY` at the time, but that cleanup was never synced to this distribution repo. Removes the now-dead variable from: - `manage-server/install.sh` / `install.ps1` — stop generating and templating the key - `manage-server/env.template` — drop the `Sessions/auth (auto-generated)` block - `manage-server/compose.yaml` — stop passing it into the container (the binary never reads it) - `manage-server/upgrade.sh` / `upgrade.ps1` — drop the backfill block (also removes `upgrade.ps1`'s now-unused `New-RandomHex` helper) Bumped `SCRIPT_VERSION` in `install.sh` and `upgrade.sh` (the two files that track it). Audited the rest of the repo for other `#600`-era JWT-auth references — none found; `manage-server/` was the only place carrying them. ## Test plan - [x] `bash -n` on `install.sh` and `upgrade.sh` - [x] PowerShell AST parse on `install.ps1` and `upgrade.ps1` - [x] `grep -rn JWT manage-server/` returns no matches - [x] Diffed against `triton` repo's `scripts/deploy/manage-server/` to confirm the target shape matches Ref: triton#861

amiryahaya added 1 commit

2026-08-22 14:16:08 +02:00

fix(manage-server): remove dead TRITON_MANAGE_JWT_SIGNING_KEY generation/passthrough 6a56646c8c

Issue #600 on triton (closed 2026-08-07) migrated manage-server admin
sessions from JWT-in-localStorage to httpOnly cookies + bcrypt, and the
source-of-truth scripts/deploy/manage-server/ in that repo dropped the
JWT signing key entirely. That cleanup never got synced here: install.sh
and install.ps1 still generated and templated the key, compose.yaml still
passed it into the container (which now ignores it), and upgrade.sh /
upgrade.ps1 still backfilled it onto older installs. Removes all of it,
plus the now-unused New-RandomHex helper in upgrade.ps1.

Ref: triton#861

amiryahaya force-pushed fix/861-remove-dead-jwt-signing-key from 6a56646c8c to 51800ecc99

2026-08-22 16:06:57 +02:00

Compare

amiryahaya merged commit 766ff00eaa into main

2026-08-22 16:07:00 +02:00

amiryahaya referenced this pull request from a commit

2026-08-22 16:07:02 +02:00

Merge pull request 'fix(manage-server): remove dead TRITON_MANAGE_JWT_SIGNING_KEY generation/passthrough' (#23) from fix/861-remove-dead-jwt-signing-key into main