From 563af88a768c11dc5068cf55af5ae4d4d9fe5d97 Mon Sep 17 00:00:00 2001
From: Jan <59206115+Threated@users.noreply.github.com>
Date: Mon, 26 Oct 2026 10:01:37 +0100
Subject: [PATCH] fix(dnpm): update authup config for current authup releases
 (#407)

- Switch system auth from robot to client: authup no longer reads
  ROBOT_ADMIN_* (since 1.0.0-beta.54) and the backend no longer accepts
  robot:// in AUTHUP_URL, so use CLIENT_SYSTEM_* and client://.
- command: server/core start -> start: the server/core prefix is
  deprecated.
- Drop the /usr/src/app/writable volume: the path no longer exists in
  the image and nothing durable is stored there with mysql.
- Replace AUTHORIZE_REDIRECT_URL with TRUSTED_ORIGINS: the old key was
  removed upstream; TRUSTED_ORIGINS controls the allowed redirect origins.
- Set NUXT_PUBLIC_ACCOUNT_URL on the portal: authup now serves the account
  console under /auth/console/account, the portal's default link 404s.

Mirrors dnpm-dip/deployment#15 and 56cc618.
---
 ccp/modules/dnpm-node-compose.yml     | 15 +++++++--------
 minimal/modules/dnpm-node-compose.yml | 15 +++++++--------
 2 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/ccp/modules/dnpm-node-compose.yml b/ccp/modules/dnpm-node-compose.yml
index 0a7bcd3..cac3135 100644
--- a/ccp/modules/dnpm-node-compose.yml
+++ b/ccp/modules/dnpm-node-compose.yml
@@ -17,18 +17,16 @@ services:
   dnpm-authup:
     image: authup/authup:latest
     container_name: bridgehead-dnpm-authup
-    volumes:
-      - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
     depends_on:
       dnpm-mysql:
         condition: service_healthy
-    command: server/core start
+    command: start
     environment:
       - PUBLIC_URL=https://${HOST}/auth/
-      - AUTHORIZE_REDIRECT_URL=https://${HOST}
-      - ROBOT_ADMIN_ENABLED=true
-      - ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET}
-      - ROBOT_ADMIN_SECRET_RESET=true
+      - TRUSTED_ORIGINS=https://${HOST}
+      - CLIENT_SYSTEM_ENABLED=true
+      - CLIENT_SYSTEM_SECRET=${DNPM_AUTHUP_SECRET}
+      - CLIENT_SYSTEM_SECRET_RESET=true
       - DB_TYPE=mysql
       - DB_HOST=dnpm-mysql
       - DB_USERNAME=root
@@ -50,6 +48,7 @@ services:
       - NUXT_PUBLIC_API_URL=https://${HOST}/api/
       - NUXT_AUTHUP_URL=http://dnpm-authup:3000/
       - NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/
+      - NUXT_PUBLIC_ACCOUNT_URL=https://${HOST}/auth/console/account
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)"
@@ -65,7 +64,7 @@ services:
       - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
       - HATEOAS_HOST=https://${HOST}
       - CONNECTOR_TYPE=broker
-      - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
+      - AUTHUP_URL=client://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
       - TZ=Europe/Berlin
     volumes:
       - /etc/bridgehead/dnpm/config:/dnpm_config
diff --git a/minimal/modules/dnpm-node-compose.yml b/minimal/modules/dnpm-node-compose.yml
index 938cc9c..0eaf47f 100644
--- a/minimal/modules/dnpm-node-compose.yml
+++ b/minimal/modules/dnpm-node-compose.yml
@@ -17,18 +17,16 @@ services:
   dnpm-authup:
     image: authup/authup:latest
     container_name: bridgehead-dnpm-authup
-    volumes:
-      - /var/cache/bridgehead/dnpm/authup:/usr/src/app/writable
     depends_on:
       dnpm-mysql:
         condition: service_healthy
-    command: server/core start
+    command: start
     environment:
       - PUBLIC_URL=https://${HOST}/auth/
-      - AUTHORIZE_REDIRECT_URL=https://${HOST}
-      - ROBOT_ADMIN_ENABLED=true
-      - ROBOT_ADMIN_SECRET=${DNPM_AUTHUP_SECRET}
-      - ROBOT_ADMIN_SECRET_RESET=true
+      - TRUSTED_ORIGINS=https://${HOST}
+      - CLIENT_SYSTEM_ENABLED=true
+      - CLIENT_SYSTEM_SECRET=${DNPM_AUTHUP_SECRET}
+      - CLIENT_SYSTEM_SECRET_RESET=true
       - DB_TYPE=mysql
       - DB_HOST=dnpm-mysql
       - DB_USERNAME=root
@@ -50,6 +48,7 @@ services:
       - NUXT_PUBLIC_API_URL=https://${HOST}/api/
       - NUXT_AUTHUP_URL=http://dnpm-authup:3000/
       - NUXT_PUBLIC_AUTHUP_URL=https://${HOST}/auth/
+      - NUXT_PUBLIC_ACCOUNT_URL=https://${HOST}/auth/console/account
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.dnpm-frontend.rule=PathPrefix(`/`)"
@@ -65,7 +64,7 @@ services:
       - MTB_RANDOM_DATA=${DNPM_SYNTH_NUM:--1}
       - HATEOAS_HOST=https://${HOST}
       - CONNECTOR_TYPE=broker
-      - AUTHUP_URL=robot://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
+      - AUTHUP_URL=client://system:${DNPM_AUTHUP_SECRET}@http://dnpm-authup:3000
       - TZ=Europe/Berlin
     volumes:
       - /etc/bridgehead/dnpm/config:/dnpm_config