single line siging key

compose.prod.yaml

@@ -7,7 +7,10 @@ services:
       PROBOD_AUTH_COOKIE_SECRET: ${PROBOD_AUTH_COOKIE_SECRET}
       PROBOD_AUTH_PASSWORD_PEPPER: ${PROBOD_AUTH_PASSWORD_PEPPER}
       PROBOD_TRUST_AUTH_TOKEN_SECRET: ${PROBOD_TRUST_AUTH_TOKEN_SECRET}
-      PROBOD_OAUTH2_SERVER_SIGNING_KEY: ${PROBOD_OAUTH2_SERVER_SIGNING_KEY}
+      # Base64-encoded (single line) so it survives Coolify's env var storage,
+      # which mangles literal embedded newlines. Decoded back into
+      # PROBOD_OAUTH2_SERVER_SIGNING_KEY by the entrypoint override below.
+      PROBOD_OAUTH2_SERVER_SIGNING_KEY_BASE64: ${PROBOD_OAUTH2_SERVER_SIGNING_KEY_BASE64}
 
       # LLM provider (required for probod to boot; at least one key)
       PROBOD_OPENAI_API_KEY: ${PROBOD_OPENAI_API_KEY}
@@ -44,6 +47,13 @@ services:
 
       # Chrome for PDF generation
       PROBOD_CHROME_DP_ADDR: "chrome:9222"
+    entrypoint:
+      - "/bin/sh"
+      - "-c"
+      - |
+        set -eu
+        export PROBOD_OAUTH2_SERVER_SIGNING_KEY="$$(printf '%s' "$$PROBOD_OAUTH2_SERVER_SIGNING_KEY_BASE64" | base64 -d)"
+        exec /usr/local/bin/entrypoint.sh
     expose:
       - "8080"
       - "8081"