From 3117e1c18e36ad650fe573a9cb34cdd904274251 Mon Sep 17 00:00:00 2001
From: glass beadian <glassbeadian@hdys.band>
Date: Tue, 13 Oct 2026 18:46:28 +0000
Subject: [PATCH] =?UTF-8?q?ops:=20OIDC=20issuer=20deployment=20wiring=20?=
 =?UTF-8?q?=E2=80=94=20key=20volume,=20CORS=20for=20files,=20Drive=20authM?=
 =?UTF-8?q?ode=20flip?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infra/occupymedia/docker-compose.app.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/infra/occupymedia/docker-compose.app.yml b/infra/occupymedia/docker-compose.app.yml
index 505210a..7820934 100644
--- a/infra/occupymedia/docker-compose.app.yml
+++ b/infra/occupymedia/docker-compose.app.yml
@@ -65,7 +65,7 @@ services:
       S3_KEK: ${S3_KEK:?}
       SUPERPOSTER_KEK: ${SUPERPOSTER_KEK:?}
       SESSION_SECRET: ${SESSION_SECRET:?}
-      CORS_ORIGINS: https://app.occupymedia.cc
+      CORS_ORIGINS: https://app.occupymedia.cc,https://files.occupymedia.cc
       PUBLIC_ORIGIN: https://app.occupymedia.cc
       WEB_ORIGIN: https://app.occupymedia.cc
       API_PUBLIC_URL: https://api.occupymedia.cc
@@ -98,6 +98,10 @@ services:
       # Publishing workflows and the scheduler worker MUST share one queue,
       # else approved publishes sit unconsumed.
       TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
+      # Hub-as-OIDC-issuer signing keys (see docs/design/2026-10-13-files-oidc-sso.md).
+      OIDC_KEY_DIR: /var/lib/tmbh/oidc
+    volumes:
+      - oidckeys:/var/lib/tmbh/oidc
     ports: ["3000:3000"]
     depends_on:
       postgres: { condition: service_healthy }
@@ -168,3 +172,4 @@ volumes:
   pgdata:
   redisdata:
   mediaworkerstate:
+  oidckeys: