From 8c37e54dbbfd6bc8bf88ca770f7669f733b8a9d3 Mon Sep 17 00:00:00 2001
From: Admin <1+admin@noreply.git.dcntrlized.org>
Date: Sun, 16 Aug 2026 17:16:37 +0100
Subject: [PATCH] build(auth): bump dcntrlized-auth to v0.1.5 (DCNTRLIZED_DEBUG
 flag)

Renames the server-side plaintext escape hatch from INSECURE_INTERNAL to
DCNTRLIZED_DEBUG in the debug compose and the listener log line; bumps the
shared auth module.
---
 docker-compose.debug.yaml | 2 +-
 src/go.mod                | 2 +-
 src/go.sum                | 4 ++--
 src/main.go               | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/docker-compose.debug.yaml b/docker-compose.debug.yaml
index dd14d54..8698691 100644
--- a/docker-compose.debug.yaml
+++ b/docker-compose.debug.yaml
@@ -50,7 +50,7 @@ services:
       # Security theme M2 §2: keep THIS listener plaintext so the RN client
       # (direct mode) and hot reload work without certs. The auth proxy edge
       # is still mTLS (mounted identity above).
-      - INSECURE_INTERNAL=1
+      - DCNTRLIZED_DEBUG=true
       # Application configuration
       # - PORT=8080
       # - ENVIRONMENT=development
diff --git a/src/go.mod b/src/go.mod
index 4272960..b9a4c5d 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -3,7 +3,7 @@ module git.dcntrlized.org/Dcntrlized/KeepNote
 go 1.26.5
 
 require (
-	git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.4
+	git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.5
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.10.0
 )
diff --git a/src/go.sum b/src/go.sum
index bb43698..7391c61 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -1,5 +1,5 @@
-git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.4 h1:QuD5/CaKqw+Ot2dr+7BYfxfw3shxhizDg5UtGIGutVc=
-git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.4/go.mod h1:BCGcoKSC+yVLRDnYZGUCBcrgu7NaFWdA39PdGG1+oNM=
+git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.5 h1:T2To6w6+8J+PlvresQawoqVUiKZWSLG0FtRLuTS/4L4=
+git.dcntrlized.org/dcntrlized/dcntrlized-auth v0.1.5/go.mod h1:BCGcoKSC+yVLRDnYZGUCBcrgu7NaFWdA39PdGG1+oNM=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
diff --git a/src/main.go b/src/main.go
index cb27ffc..8a9cfb1 100644
--- a/src/main.go
+++ b/src/main.go
@@ -76,14 +76,14 @@ func main() {
 
 	// Security theme M2 §2: the service's listener requires a CA-issued client
 	// cert (Maestro's identity) so only Maestro can drive actions (T4) and the
-	// peer edge is encrypted. INSECURE_INTERNAL=1 keeps the dev fleet plaintext.
+	// peer edge is encrypted. DCNTRLIZED_DEBUG=true keeps the debug fleet plaintext.
 	tlsCfg, err := tlsutil.ServerConfig()
 	if err != nil {
 		logger.Error("TLS setup failed: %v", err)
 		os.Exit(1)
 	}
 	if tlsCfg == nil {
-		logger.Info("KeepNote listening plaintext on :8080 (INSECURE_INTERNAL dev mode)")
+		logger.Info("KeepNote listening plaintext on :8080 (DCNTRLIZED_DEBUG dev mode)")
 		if err := http.ListenAndServe(":8080", handler); err != nil {
 			logger.Error("HTTP server failed: %v", err)
 			os.Exit(1)