Error 500 after updating to 6.2.7: Missing Application Encryption Key (APP_KEY)

[rubenqba]

Support guidelines

• I've read the support guidelines

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem
• ... it's definitely a Firefly III issue, not me

Description

After updating my self-hosted Docker Swarm deployment to the 6.2.7 tag, the application began returning HTTP 500 errors. The logs consistently show the following error when accessing the application:

PHP Fatal error:  Uncaught Illuminate\Encryption\MissingAppKeyException: No application encryption key has been specified. in /var/www/html/vendor/laravel/framework/src/Illuminate/Encryption/EncryptionServiceProvider.php:83

Steps Taken:

1. Confirmed that APP_KEY is configured via a secret file and properly referenced using APP_KEY_FILE in the Compose file.
2. Tested removing APP_KEY_FILE and directly defining APP_KEY in the environment (with the secret value), but neither approach resolved the issue.
3. Rolled back to the previously stable version (6.2.4), but the error persists.

Suspected Cause:

Since downgrading did not resolve the problem, I suspect the issue might be related to a database migration or a configuration change introduced in the newer version(s) that affects the encryption key setup.

Debug information

Got error 500 accessing /debug endpoint

Expected behaviour

No response

Steps to reproduce

No response

Additional info

• The application was functioning correctly before the update.
• The APP_KEY secret file has not been modified and works in other environments.

[JC5]

Hey, thanks for starting this discussion.

This is not a bug, but a side effect of the container no longer using root. See https://docs.firefly-iii.org/references/faq/docker/#can-i-use-docker-secrets

Cheers,
James

[rubenqba]

This does not apply to my scenario. The secrets were not created via file-based secrets, and the permissions on the mounted secrets files are world-readable.

$ docker exec ff3_app.1.68e8dht71vwi4jotinqcsmhm5 ls -lFh /run/secrets
total 16K
-r--r--r-- 1 root root 33 Feb 19 17:43 api_encryption_key
-r--r--r-- 1 root root 33 Feb 19 17:43 crontab_token
-r--r--r-- 1 root root 25 Feb 19 17:43 db_user_password
-r--r--r-- 1 root root 17 Feb 19 17:43 gmail_password

$ docker exec ff3_app.1.68e8dht71vwi4jotinqcsmhm5 cat /run/secrets/api_encryption_key
here-redacted-secret

Additionally, I believe that if the issue were caused by the newer images not using the root user, rolling back to the 6.2.4 image (which worked flawlessly before) should have resolved the problem. However, this did not happen. For this reason, I still suspect that a configuration change occurred when I updated to a later version.