🔧(dev) generate the JWT signing key when bootstrapping the dev stack

Thw private key needed to generate a jwt token will be mandatory. In
order to ease the development we want to automate its generation

bin/_config.sh

@@ -38,6 +38,10 @@ function _set_user() {
 # options: docker compose command options
 # ARGS   : docker compose command arguments
 function _docker_compose() {
+    # The backend settings point at this key and the containers mount it, so it
+    # has to exist before any of them starts.
+    "${REPO_DIR}/bin/generate-jwt-private-key.sh"
+
     # Set DOCKER_USER for Windows compatibility with MinIO
     if [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || -n "${WSL_DISTRO_NAME:-}" ]]; then
         export DOCKER_USER="0:0"

bin/generate-jwt-private-key.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+# Generate the RSA private key signing the JWT tokens issued by the backend.
+#
+# Development only. The key is generated locally and never committed: it lands
+# in "data/", which is gitignored. The dev stack mounts it in the backend
+# containers, where JWT_PRIVATE_KEY_FILE points at it.
+#
+# Idempotent: an existing key is kept. Delete the file to roll the key.
+
+set -eo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+KEY_PATH="${REPO_DIR}/data/jwt/private.pem"
+
+if [ -f "${KEY_PATH}" ]; then
+    exit 0
+fi
+
+mkdir -p "$(dirname "${KEY_PATH}")"
+openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "${KEY_PATH}" 2>/dev/null
+chmod 600 "${KEY_PATH}"
+echo "✓ JWT private key generated in ${KEY_PATH}"