From 8ba045063d49b665ae14c08e5bdd44bb15c0b768 Mon Sep 17 00:00:00 2001
From: Josh Creek <8179928+jcreek@users.noreply.github.com>
Date: Sat, 5 Sep 2026 18:19:56 +0100
Subject: [PATCH] fix(compose): give the allocated smoke's allocator its
 signing key

Making cmd/allocator refuse to start without join-signing material was
right -- an allocator that binds allocations it can never publish rosters
for strands every match silently -- but I updated the Kubernetes
manifests and the kind fixture without updating the Compose one. The
allocator container exited at startup, so no allocation was ever bound
and verify-allocated-compose failed with "allocator did not bind a
provider allocation".

Mount the same join-signing-keys.json fixture the game server already
uses and name the key it was written with. Caught by running the target
locally rather than by CI after a push.
---
 compose.allocated-smoke.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/compose.allocated-smoke.yml b/compose.allocated-smoke.yml
index 065d698c..6ebf40a7 100644
--- a/compose.allocated-smoke.yml
+++ b/compose.allocated-smoke.yml
@@ -58,7 +58,11 @@ services:
       COSMIC_CLASH_WORKLOAD_SECRET: compose-workload-secret
       COSMIC_CLASH_KUBERNETES_TOKEN_PATH: /run/cosmic-clash/kubernetes-token
       COSMIC_CLASH_KUBERNETES_CA_PATH: /run/cosmic-clash/fake-agones.crt
-    command: ["--dsn=postgres://cosmic_clash_test:cosmic_clash_test@database:5432/cosmic_clash_test?sslmode=disable", "--migrations=/opt/cosmic-clash/migrations", "--interval=1s", "--transport=enet"]
+    # The allocator signs one join authorisation per participant and publishes
+    # the assignment roster, so it needs the same key material the game server
+    # verifies with. It refuses to start without them rather than binding
+    # allocations that could never become joinable.
+    command: ["--dsn=postgres://cosmic_clash_test:cosmic_clash_test@database:5432/cosmic_clash_test?sslmode=disable", "--migrations=/opt/cosmic-clash/migrations", "--interval=1s", "--transport=enet", "--join-authorisations-key-file=/run/secrets/cosmic-clash/join-signing-keys.json", "--join-authorisations-key-id=compose-key-1"]
     depends_on:
       database:
         condition: service_healthy
@@ -67,6 +71,7 @@ services:
     volumes:
       - ${COMPOSE_SMOKE_DIR:-/tmp/cosmic-clash-allocated-smoke}/kubernetes-token:/run/cosmic-clash/kubernetes-token:ro
       - ${COMPOSE_SMOKE_DIR:-/tmp/cosmic-clash-allocated-smoke}/fake-agones.crt:/run/cosmic-clash/fake-agones.crt:ro
+      - ${COMPOSE_SMOKE_DIR:-/tmp/cosmic-clash-allocated-smoke}/join-signing-keys.json:/run/secrets/cosmic-clash/join-signing-keys.json:ro
 
   maintenance:
     build: