From 482e043e675433ad0819cc7f5af65f7020225004 Mon Sep 17 00:00:00 2001
From: Alex <a@tushynski.me>
Date: Sat, 5 Sep 2026 18:03:21 +0100
Subject: [PATCH] docs(docker): INTERNAL_KEY is required for a hand-written
 .env

The worker hands finished indexes to the API through an internal endpoint
that rejects every request while INTERNAL_KEY is unset, so a .env written by
hand from the docs' minimal example made every upload end in a 401. setup.sh
generates the key; the standalone compose header and the Docker guide now
generate one too.
---
 deployment/docker-compose-standalone.yaml   |  7 +++++--
 docs/content/Deploying/Docker-Deploying.mdx | 10 +++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/deployment/docker-compose-standalone.yaml b/deployment/docker-compose-standalone.yaml
index 937de312..0dc9d893 100644
--- a/deployment/docker-compose-standalone.yaml
+++ b/deployment/docker-compose-standalone.yaml
@@ -1,8 +1,11 @@
 # DocsGPT from pre-built images, with no git checkout.
 #
 #   curl -fsSLO https://raw.githubusercontent.com/arc53/DocsGPT/main/deployment/docker-compose-standalone.yaml
-#   printf 'LLM_PROVIDER=docsgpt\nVITE_API_STREAMING=true\n' > .env   # or any provider, see the settings guide
-#   docker compose up -d
+#   printf 'LLM_PROVIDER=docsgpt\nVITE_API_STREAMING=true\nINTERNAL_KEY=%s\n' "$(openssl rand -hex 16)" > .env
+#   docker compose -f docker-compose-standalone.yaml up -d
+#
+# INTERNAL_KEY is the shared secret the worker uses to hand finished indexes to
+# the API; without it every ingest fails with a 401 (setup.sh generates one).
 #   open http://localhost:5173
 #
 # Every release also attaches this file as an asset. Settings come from .env
diff --git a/docs/content/Deploying/Docker-Deploying.mdx b/docs/content/Deploying/Docker-Deploying.mdx
index 2ab0a03c..1fb822c3 100644
--- a/docs/content/Deploying/Docker-Deploying.mdx
+++ b/docs/content/Deploying/Docker-Deploying.mdx
@@ -36,10 +36,13 @@ first use. You do not need the source tree to run them:
 
 2.  **Create a `.env` next to it** with your settings, for example the public API:
 
+    ```bash
+    printf 'LLM_PROVIDER=docsgpt\nVITE_API_STREAMING=true\nINTERNAL_KEY=%s\n' "$(openssl rand -hex 16)" > .env
     ```
-    LLM_PROVIDER=docsgpt
-    VITE_API_STREAMING=true
-    ```
+
+    `INTERNAL_KEY` is the secret the worker uses to hand finished indexes to
+    the API; without it every upload fails with a 401. `setup.sh` generates
+    one for you, a hand-written `.env` has to include it.
 
 3.  **Start it:**
 
@@ -87,6 +90,7 @@ extra packages: `EXTRAS=docling` in `.env`).
     ```
     LLM_PROVIDER=docsgpt
     VITE_API_STREAMING=true
+    INTERNAL_KEY=<any random string, e.g. openssl rand -hex 16>
     ```
 
     This minimal configuration tells DocsGPT to use the public API. For more advanced settings and other LLM options, refer to the [DocsGPT Settings Guide](/Deploying/DocsGPT-Settings).