From 85e06567f3054b6fc7349aa1f65809db47c9034a Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Fri, 19 Jun 2026 23:26:55 +0900
Subject: Require REGISTER_TOKEN to create a passkey

Prevents anyone who finds /auth/register from registering.
Token is set via REGISTER_TOKEN env var on the server.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 docker-compose.yml | 1 +
 1 file changed, 1 insertion(+)

(limited to 'docker-compose.yml')

diff --git a/docker-compose.yml b/docker-compose.yml
index bd00608..b617cbc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,6 +12,7 @@ services:
       - NODE_ENV=production
       - DB_PATH=/app/data/microblog.db
       - SESSION_SECRET=${SESSION_SECRET}
+      - REGISTER_TOKEN=${REGISTER_TOKEN}
       - WEBAUTHN_RP_ID=blog.yyamashita.com
       - WEBAUTHN_ORIGIN=https://blog.yyamashita.com
     restart: unless-stopped
-- 
cgit v1.2.3