From 4b4afa2eae4f1dac629e88a73e9dcab95d12b3a4 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 27 Jun 2026 18:25:26 +0100
Subject: [PATCH] docker-compose: explicit source/target mapping for build
 secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shorthand 'secrets: - yavsc_appsettings' relies on Compose
v2 to derive both source and target from the same name. In
some BuildKit integrations this is not enough — the secret id
seen inside the Dockerfile (yavsc_appsettings) and the source
defined at top-level (yavsc_appsettings, file: ...) end up not
being mapped correctly, leading to:

  cp: cannot stat '/run/secrets/yavsc_appsettings':
    No such file or directory

at the blogs-runtime / api-runtime / web-runtime stages.

Use the explicit long form:

  secrets:
    - source: yavsc_appsettings
      target: yavsc_appsettings

in all three runtime services. source is the top-level secret
name (file: ./src/Yavsc.Org/appsettings-org.json); target is
the id BuildKit exposes inside the container at
/run/secrets/yavsc_appsettings, matching --mount=type=secret,
id=yavsc_appsettings in the Dockerfile.
---
 docker-compose.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index 0b00a20f..f478dcc9 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -28,7 +28,8 @@ services:
       args:
         BUILD_ENV_TAG: debian12-dotnet10-android36-v1
       secrets:
-        - yavsc_appsettings
+        - source: yavsc_appsettings
+          target: yavsc_appsettings
     env_file: .env
     # ASPNETCORE_URLS forcé à HTTP seul en dev. Le HTTPS (port 5001)
     # est désactivé par défaut parce qu'aucun certificat n'est
@@ -74,7 +75,8 @@ services:
       args:
         BUILD_ENV_TAG: debian12-dotnet10-android36-v1
       secrets:
-        - yavsc_appsettings
+        - source: yavsc_appsettings
+          target: yavsc_appsettings
     env_file: .env
     # ASPNETCORE_URLS forcé à HTTP seul en dev. Voir commentaire détaillé
     # dans le service `web` ci-dessus ; même logique pour l'API.
@@ -105,7 +107,8 @@ services:
       args:
         BUILD_ENV_TAG: debian12-dotnet10-android36-v1
       secrets:
-        - yavsc_appsettings
+        - source: yavsc_appsettings
+          target: yavsc_appsettings
     env_file: .env
     # ASPNETCORE_URLS forcé à HTTP seul en dev. Voir commentaire détaillé
     # dans le service `web` ci-dessus ; même logique pour les blogs.