refactor(builder): replace runtime JWT signing with pre-minted bearer

Builder now reads a pre-minted JWT from BUILDER_JWT_PATH (default
/etc/coolify/builder-jwt) instead of loading an EC private key and
signing its own token. Mirrors coold's model where central mints the
bearer, avoiding per-builder private key distribution.

Also corrects the default BUILDER_BROKER_URL port from 6443 (coold
stream) to 6444 (builder stream).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: andrasbacsai

builder/src/auth.rs

@@ -12,17 +12,17 @@ pub struct Config {
     #[arg(long, env = "BUILDER_ID")]
     pub builder_id: String,
 
-    /// Broker gRPC address to dial.
-    #[arg(long, env = "BUILDER_BROKER_URL", default_value = "http://127.0.0.1:6443")]
+    /// Broker gRPC address to dial (builder-stream listener, default :6444).
+    #[arg(long, env = "BUILDER_BROKER_URL", default_value = "http://127.0.0.1:6444")]
     pub broker_url: String,
 
-    /// PEM-encoded EC/RSA private key for signing the builder JWT.
-    #[arg(long, env = "BUILDER_JWT_PRIVATE_KEY_PATH", default_value = "/etc/coolify/builder.key")]
-    pub jwt_private_key_path: std::path::PathBuf,
+    /// Path to the pre-minted ES256 bearer JWT signed by central (aud="builder").
+    #[arg(long, env = "BUILDER_JWT_PATH", default_value = "/etc/coolify/builder-jwt")]
+    pub jwt_path: std::path::PathBuf,
 
-    /// Loaded private key — populated at startup.
+    /// Loaded bearer token — populated at startup.
     #[clap(skip)]
-    pub jwt_private_key: String,
+    pub jwt: String,
 
     /// Directory for temporary build work dirs.
     #[arg(long, env = "BUILDER_WORK_DIR", default_value = "/var/lib/coolify-builder/work")]
@@ -40,9 +40,10 @@ pub struct Config {
 impl Config {
     pub async fn load() -> anyhow::Result<Self> {
         let mut cfg = Self::parse();
-        cfg.jwt_private_key = tokio::fs::read_to_string(&cfg.jwt_private_key_path)
+        cfg.jwt = tokio::fs::read_to_string(&cfg.jwt_path)
             .await
-            .map_err(|e| anyhow::anyhow!("read JWT privkey {}: {e}", cfg.jwt_private_key_path.display()))?;
+            .map_err(|e| anyhow::anyhow!("read JWT from {}: {e}", cfg.jwt_path.display()))?;
+        cfg.jwt = cfg.jwt.trim().to_owned();
         tokio::fs::create_dir_all(&cfg.work_dir).await?;
         Ok(cfg)
     }

builder/src/config.rs

@@ -1,4 +1,3 @@
-mod auth;
 mod config;
 mod executor;
 mod progress;

builder/src/main.rs

@@ -9,7 +9,7 @@ use coolify_proto::builder::v1::{
     BuilderHello,
 };
 
-use crate::{auth, config::Config};
+use crate::config::Config;
 
 const RECONNECT_DELAY_SECS: u64 = 5;
 
@@ -33,8 +33,7 @@ async fn connect_and_run(config: &Config) -> Result<()> {
         .connect()
         .await?;
 
-    let token = auth::sign_jwt(&config.builder_id, &config.jwt_private_key)?;
-    let bearer: MetadataValue<_> = format!("Bearer {token}").parse()?;
+    let bearer: MetadataValue<_> = format!("Bearer {}", config.jwt).parse()?;
 
     let mut client = BuilderClient::with_interceptor(channel, move |mut req: tonic::Request<()>| {
         req.metadata_mut().insert("authorization", bearer.clone());