From 21c7642b347997f1c6d3400bdc766e16d190414f Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Thu, 11 Jun 2026 00:34:09 -0700
Subject: [PATCH] fix: revive dawarich, technitium, openspeedtest (broken since
 jan 16)

three services silently crash-looping for five months, all casualties
of the jan 16 image/user changes:
- dawarich: rails 8 requires SECRET_KEY_BASE; new DAWARICH_SECRET_KEY_BASE
  env var (added to generate-env.sh and the deployed .env)
- technitium: new image writes blocklists to /etc/dns, which was
  root-owned in-container; mount a writable volume there
- openspeedtest: the image entrypoint rewrites nginx config as root;
  drop the user override that broke it
---
 compose.yaml    | 4 +++-
 generate-env.sh | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/compose.yaml b/compose.yaml
index c45bc074e77b6581e7277dab4da3bc6fe4b6e1a8..f4cdec4262e2ff90ad3ed7ed11b8a048623e97f8 100755
--- a/compose.yaml
+++ b/compose.yaml
@@ -640,6 +640,7 @@ services:
     user: "$USER_ID:$GROUP_ID"
     environment:
       RAILS_ENV: production
+      SECRET_KEY_BASE: "${DAWARICH_SECRET_KEY_BASE:?}"
       REDIS_URL: "redis://redis:6379"
       DATABASE_HOST: postgres
       DATABASE_USERNAME: dawarich
@@ -677,6 +678,7 @@ services:
     user: "$USER_ID:$GROUP_ID"
     environment:
       RAILS_ENV: production
+      SECRET_KEY_BASE: "${DAWARICH_SECRET_KEY_BASE:?}"
       REDIS_URL: "redis://redis:6379"
       DATABASE_HOST: postgres
       DATABASE_USERNAME: dawarich
@@ -768,7 +770,6 @@ services:
     restart: unless-stopped
     container_name: openspeedtest
     image: openspeedtest/latest
-    user: "$USER_ID:$GROUP_ID"
     labels:
       net.paperclover.list.name: Open Speed Test
       net.paperclover.list.domain: speedtest
@@ -785,6 +786,7 @@ services:
       - 8053:8053/tcp # dns over http
     volumes:
       - "${APP_ROOT}/technitium/config:/app/config"
+      - "${APP_ROOT}/technitium/dns:/etc/dns"
       - "${APP_ROOT}/technitium/ssl:/etc/ssl"
       - "${APP_ROOT}/technitium/logs:/app/config/logs"
     restart: unless-stopped
diff --git a/generate-env.sh b/generate-env.sh
index 593085417302e78216a0e816c823c55cca265044..f9a90d764b6c0a6cd60863ad7f9649be4ee5bcfb 100644
--- a/generate-env.sh
+++ b/generate-env.sh
@@ -39,6 +39,9 @@ template() {
   section "authentication"
   add "KEYCLOAK_ADMIN_PASSWORD" "$(secret 12)"
 
+  section "dawarich"
+  add "DAWARICH_SECRET_KEY_BASE" "$(hex_secret 64)"
+
   section "postgres"
   add "POSTGRES_PASSWORD" "$(secret 32)"
   add "POSTGRES_PASSWORD_KEYCLOAK" "$(secret 32)"
-- 
2.54.0