From 95005b758f37f0dbf76597997e49ce87fb89e381 Mon Sep 17 00:00:00 2001
From: Eli Fouts <eligfouts@gmail.com>
Date: Fri, 27 Feb 2026 03:11:22 -0500
Subject: [PATCH] fix: normalize line endings in docker-entrypoint.sh and
 update Dockerfile to handle script permissions

---
 .gitattributes               | 3 +++
 backend/Dockerfile           | 2 +-
 backend/docker-entrypoint.sh | 8 --------
 3 files changed, 4 insertions(+), 9 deletions(-)
 create mode 100644 .gitattributes

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..5c6302e
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+*.sh text eol=lf
+*.bash text eol=lf
+*.ps1 text eol=crlf
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 0861534..61aa0ac 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -43,7 +43,7 @@ EXPOSE 8080
 # Install openssl (used by entrypoint to generate secrets) and make entrypoint executable
 RUN apk add --no-cache openssl
 COPY docker-entrypoint.sh ./docker-entrypoint.sh
-RUN chmod +x ./docker-entrypoint.sh
+RUN sed -i 's/\r$//' ./docker-entrypoint.sh && chmod +x ./docker-entrypoint.sh
 
 # Entrypoint generates environment secrets if missing, then runs the app.
 # Use /bin/sh explicitly to avoid shebang/line-ending portability issues.
diff --git a/backend/docker-entrypoint.sh b/backend/docker-entrypoint.sh
index 02cc626..283ff1e 100644
--- a/backend/docker-entrypoint.sh
+++ b/backend/docker-entrypoint.sh
@@ -1,17 +1,10 @@
 #!/bin/sh
 set -e
 
-# By default do NOT generate a random DEVBITS_JWT_SECRET here. Generating a
-# new random secret at container start causes tokens signed by the backend to
-# change on each restart which breaks client sessions during local development.
-#
-# If you explicitly want a random secret (production automation), set
-# DEVBITS_FORCE_RANDOM_JWT_SECRET=1 and a 32-byte hex secret will be generated.
 if [ -z "$DEVBITS_JWT_SECRET" ] && [ "$DEVBITS_FORCE_RANDOM_JWT_SECRET" = "1" ]; then
   if command -v openssl >/dev/null 2>&1; then
     export DEVBITS_JWT_SECRET="$(openssl rand -hex 32)"
   else
-    # Fallback using /dev/urandom and od
     export DEVBITS_JWT_SECRET=$(head -c 32 /dev/urandom | od -An -v -tx1 | tr -d ' \n')
   fi
   echo "Generated DEVBITS_JWT_SECRET"
@@ -21,5 +14,4 @@ else
   fi
 fi
 
-# Execute the container command
 exec "$@"