indiekit: Cannot authenticate into Indiekit (hosted on Fly.io)

Description of the bug

Hi there, I’ve been trying to get set up with an install of the latest Indiekit (1.0.0 beta 2), and since Heroku doesn’t have a free plan any more, I’ve been trying to set it up on Fly.io.

I’ve been able to get Indiekit to run, but I can’t authenticate into it. I believe I’ve set the relevant required environment variables – first SECRET (because Indiekit wouldn’t let me create a new password until I’d set that), and then I created a password and used the generated hash to set PASSWORD_SECRET too. I set both of these using Fly’s command-line tool. And I can verify that these are both set, using the command-line tool and via the web interface, although I can’t inspect the contents of the variables (they’re hashed).

My problem is that when I try to log in to Indiekit, and enter the password I’d used, the app just keeps telling me “Enter a valid password”. I’m pretty certain the password is correct (I used Bitwarden to generate it and have been copying and pasting) so I feel like something’s gone wrong with the environment variables, but I don’t know what.

I also tried just sidestepping this problem by setting application.authorizationEndpoint and application.tokenEndpoint to the old IndieAuth URLs, as per the documentation, but Indiekit seems to be ignoring that and just keeps sending me to its own password-based authentication screen. Unless I’ve misunderstood how providing an alternative authentication/token endpoint is supposed to work and a password is still a prerequisite. Or unless I’ve set it wrong, because to be fair, I also tried setting a custom application.name and I don’t see the name I set that to anywhere. I did follow the format in the example config, copy-pasting the MongoDB URL line and changing the key and value (with quotes around the value strings). Basically that section goes:

  application: {
	authorizationEndpoint: "https://indieauth.com/auth",
	mongodbUrl: process.env.MONGO_URL,
	name: "JLS Indiekit",
	tokenEndpoint: "https://tokens.indieauth.com/token",
  },

While on one level it’d obviously be better to understand why Indiekit’s built-in authentication isn’t working in the first place, I’d also be happy with a solution that let me revert to the old way of authenticating (which worked in 0.3.0).

Short of “abandoning Fly.io and trying a different host”, I’m all out of ideas, but I also don’t know why Indiekit wouldn’t work on Fly.io. Anyway, apologies for my obvious inexpertise with things like this; I’m very thankful for all the work you’ve put into Indiekit and would appreciate any help understanding where this is going wrong 🙏

Steps to reproduce

No response

Expected behaviour

No response

Environment

No response

Additional context

No response