From 98597232f29dd95a146c11eac3c6c2c1de0fd5ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 3 Sep 2026 02:12:44 +0200
Subject: [PATCH] fix(notifications): drop the unreachable WEB_PUSH_* VAPID
 aliases

Six WEB_PUSH_* names and NEXT_PUBLIC_VAPID_PUBLIC_KEY sat behind the three
real VAPID_* variables in the env fallback. None was ever on the compose
environment: whitelist and none appeared in .env.example, .env.production.example
or the env manifest, so under the bundled stack a value set under any of them
could not reach the process. Remove them and the self-hosting note that
advertised them.
---
 docs/self-hosting/notifications.md    |  6 ++----
 src/lib/notifications/vapid-config.ts | 27 ++++++++++++++-------------
 2 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/docs/self-hosting/notifications.md b/docs/self-hosting/notifications.md
index b3bd02df0..6f7e01ab1 100644
--- a/docs/self-hosting/notifications.md
+++ b/docs/self-hosting/notifications.md
@@ -91,10 +91,8 @@ VAPID_PRIVATE_KEY="...(private key)"
 VAPID_SUBJECT="mailto:you@example.com"
 ```
 
-The database values win when both are present. The loader also accepts a
-few aliases (`WEB_PUSH_VAPID_PUBLIC_KEY`, `WEB_PUSH_PUBLIC_KEY`, and the
-private/subject equivalents) so a config copied from another deployment
-keeps working.
+The database values win when both are present. These three names are the
+only ones the loader reads.
 
 ### 3. Subscribe a device
 
diff --git a/src/lib/notifications/vapid-config.ts b/src/lib/notifications/vapid-config.ts
index 228653776..cd2a87659 100644
--- a/src/lib/notifications/vapid-config.ts
+++ b/src/lib/notifications/vapid-config.ts
@@ -8,20 +8,21 @@ export interface VapidConfig {
   subject: string;
 }
 
+/**
+ * The env fallback, read when the admin Settings panel has no key pair stored.
+ *
+ * `VAPID_PUBLIC_KEY` / `VAPID_PRIVATE_KEY` / `VAPID_SUBJECT` are the only
+ * names. Six `WEB_PUSH_*` aliases and a `NEXT_PUBLIC_VAPID_PUBLIC_KEY` one
+ * used to sit behind them; none was ever on the compose `environment:`
+ * whitelist, so under the bundled stack a value set under any of those names
+ * could not reach this process, and none appeared in `.env.example`,
+ * `.env.production.example` or the env manifest. They read as an escape hatch
+ * that had never been open.
+ */
 function fromEnv(): VapidConfig | null {
-  const publicKey =
-    process.env.VAPID_PUBLIC_KEY ??
-    process.env.NEXT_PUBLIC_VAPID_PUBLIC_KEY ??
-    process.env.WEB_PUSH_VAPID_PUBLIC_KEY ??
-    process.env.WEB_PUSH_PUBLIC_KEY;
-  const privateKey =
-    process.env.VAPID_PRIVATE_KEY ??
-    process.env.WEB_PUSH_VAPID_PRIVATE_KEY ??
-    process.env.WEB_PUSH_PRIVATE_KEY;
-  const subject =
-    process.env.VAPID_SUBJECT ??
-    process.env.WEB_PUSH_VAPID_SUBJECT ??
-    process.env.WEB_PUSH_SUBJECT;
+  const publicKey = process.env.VAPID_PUBLIC_KEY;
+  const privateKey = process.env.VAPID_PRIVATE_KEY;
+  const subject = process.env.VAPID_SUBJECT;
 
   if (!publicKey || !privateKey || !subject) return null;
   return { publicKey, privateKey, subject };