ops: pin shared Temporal publishing queue; pass MATRIX_SSO_AS_TOKEN/HS_TOKEN to api

W1's governance sim found approved publishes never executing: the api starts
workflows on tmbh-publishing while the 3-day-old scheduler image consumed the
old superposter-publishing default. Pin TEMPORAL_TASK_QUEUE on both services.
This commit is contained in:
glass beadian 2026-10-13 15:35:49 +00:00
parent 4a0d398a76
commit 189cb41a09

View file

@ -85,14 +85,19 @@ services:
ARCHIVE_PROVISIONER_HOMESERVER_URL: ${ARCHIVE_PROVISIONER_HOMESERVER_URL:-}
ARCHIVE_PROVISIONER_USER: ${ARCHIVE_PROVISIONER_USER:-}
ARCHIVE_PROVISIONER_PASSWORD: ${ARCHIVE_PROVISIONER_PASSWORD:-}
# In-app Chat sign-in: same secret as [global.jwt] key in tuwunel.toml.
# In-app Chat sign-in: appservice tokens, see appservice.hub in tuwunel.toml.
# Unset = the Chat view falls back to Element's own sign-in screen.
MATRIX_SSO_JWT_SECRET: ${MATRIX_SSO_JWT_SECRET:-}
MATRIX_SSO_AS_TOKEN: ${MATRIX_SSO_AS_TOKEN:-}
MATRIX_SSO_HS_TOKEN: ${MATRIX_SSO_HS_TOKEN:-}
MATRIX_SSO_HOMESERVER_URL: ${MATRIX_SSO_HOMESERVER_URL:-https://chat.occupymedia.cc}
MATRIX_SSO_LOCALPART_PREFIX: ${MATRIX_SSO_LOCALPART_PREFIX:-}
# In-app Drive: oCIS web origin + auth mode (interactive | oidc).
FILES_DRIVE_URL: ${FILES_DRIVE_URL:-https://files.occupymedia.cc}
FILES_DRIVE_AUTH: ${FILES_DRIVE_AUTH:-interactive}
# Publishing workflows and the scheduler worker MUST share one queue,
# else approved publishes sit unconsumed.
TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
ports: ["3000:3000"]
depends_on:
postgres: { condition: service_healthy }
@ -109,6 +114,7 @@ services:
PORT: "3010"
SCHEDULER_DATABASE_URL: ${SCHEDULER_DATABASE_URL:?Set the sp_app runtime URL}
SCHEDULER_HEALTH_PORT: "8081"
TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
healthcheck:
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8081/readyz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
interval: 10s