From 189cb41a09e03a6efc3722be21111aa14a7610c2 Mon Sep 17 00:00:00 2001
From: glass beadian <glassbeadian@hdys.band>
Date: Tue, 13 Oct 2026 15:35:49 +0000
Subject: [PATCH] ops: pin shared Temporal publishing queue; pass
 MATRIX_SSO_AS_TOKEN/HS_TOKEN to api

W1's governance sim found approved publishes never executing: the api starts
workflows on tmbh-publishing while the 3-day-old scheduler image consumed the
old superposter-publishing default. Pin TEMPORAL_TASK_QUEUE on both services.
---
 infra/occupymedia/docker-compose.app.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/infra/occupymedia/docker-compose.app.yml b/infra/occupymedia/docker-compose.app.yml
index ebcfb95..505210a 100644
--- a/infra/occupymedia/docker-compose.app.yml
+++ b/infra/occupymedia/docker-compose.app.yml
@@ -85,14 +85,19 @@ services:
       ARCHIVE_PROVISIONER_HOMESERVER_URL: ${ARCHIVE_PROVISIONER_HOMESERVER_URL:-}
       ARCHIVE_PROVISIONER_USER: ${ARCHIVE_PROVISIONER_USER:-}
       ARCHIVE_PROVISIONER_PASSWORD: ${ARCHIVE_PROVISIONER_PASSWORD:-}
-      # In-app Chat sign-in: same secret as [global.jwt] key in tuwunel.toml.
+      # In-app Chat sign-in: appservice tokens, see appservice.hub in tuwunel.toml.
       # Unset = the Chat view falls back to Element's own sign-in screen.
       MATRIX_SSO_JWT_SECRET: ${MATRIX_SSO_JWT_SECRET:-}
+      MATRIX_SSO_AS_TOKEN: ${MATRIX_SSO_AS_TOKEN:-}
+      MATRIX_SSO_HS_TOKEN: ${MATRIX_SSO_HS_TOKEN:-}
       MATRIX_SSO_HOMESERVER_URL: ${MATRIX_SSO_HOMESERVER_URL:-https://chat.occupymedia.cc}
       MATRIX_SSO_LOCALPART_PREFIX: ${MATRIX_SSO_LOCALPART_PREFIX:-}
       # In-app Drive: oCIS web origin + auth mode (interactive | oidc).
       FILES_DRIVE_URL: ${FILES_DRIVE_URL:-https://files.occupymedia.cc}
       FILES_DRIVE_AUTH: ${FILES_DRIVE_AUTH:-interactive}
+      # Publishing workflows and the scheduler worker MUST share one queue,
+      # else approved publishes sit unconsumed.
+      TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
     ports: ["3000:3000"]
     depends_on:
       postgres: { condition: service_healthy }
@@ -109,6 +114,7 @@ services:
       PORT: "3010"
       SCHEDULER_DATABASE_URL: ${SCHEDULER_DATABASE_URL:?Set the sp_app runtime URL}
       SCHEDULER_HEALTH_PORT: "8081"
+      TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8081/readyz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
       interval: 10s