Update Dockerfile

Dockerfile

@@ -125,14 +125,26 @@ mkdir -p /app/data
 # @atproto/crypto import is needed (it is not resolvable under pnpm layout).
 if [ ! -f "$SECRETS_FILE" ]; then
   echo "[entrypoint] first boot - generating secrets"
-  {
-    echo "PDS_JWT_SECRET=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')"
-    echo "PDS_ADMIN_PASSWORD=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')"
-    echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(node -e 'console.log(require("crypto").randomBytes(32).toString("hex"))')"
-  } > "$SECRETS_FILE"
-  chmod 600 "$SECRETS_FILE" || true
+  : > "$SECRETS_FILE"
 fi
-. "$SECRETS_FILE"
+
+# Backfill any missing secret individually (covers files created by older
+# image versions that crashed mid-generation).
+. "$SECRETS_FILE" || true
+
+if [ -z "${PDS_JWT_SECRET:-}" ]; then
+  PDS_JWT_SECRET=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')
+  echo "PDS_JWT_SECRET=$PDS_JWT_SECRET" >> "$SECRETS_FILE"
+fi
+if [ -z "${PDS_ADMIN_PASSWORD:-}" ]; then
+  PDS_ADMIN_PASSWORD=$(node -e 'console.log(require("crypto").randomBytes(16).toString("hex"))')
+  echo "PDS_ADMIN_PASSWORD=$PDS_ADMIN_PASSWORD" >> "$SECRETS_FILE"
+fi
+if [ -z "${PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX:-}" ]; then
+  PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(node -e 'console.log(require("crypto").randomBytes(32).toString("hex"))')
+  echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX" >> "$SECRETS_FILE"
+fi
+chmod 600 "$SECRETS_FILE" || true
 export PDS_JWT_SECRET PDS_ADMIN_PASSWORD PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
 
 # PDS_HOSTNAME must be a bare hostname (no scheme, no trailing slash).
@@ -193,4 +205,4 @@ ENV PDS_HOSTNAME=https://cloudunity-gemma-api1.hf.space
 
 EXPOSE 7860
 
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]