fix: uncomment MUTINY_API_TOKEN and MUTINY_API_URL for web service (fixes #17)

[slsgzs-cloud]

Fixes #17

The web service in docker-compose.yml had MUTINY_API_TOKEN and MUTINY_API_URL commented out. This meant:

1. The Next.js middleware (apps/web/src/middleware.ts) only injects Authorization when MUTINY_API_TOKEN is set on the web process — it was unset, so rewrites to the API had no auth header.
2. Rewrites defaulted to http://127.0.0.1:8000 (from apps/web/next.config.ts), which is wrong inside a container — the correct URL is http://api:8000 (the Docker service name).

Result: the web UI could not reach the API, and any request that required Bearer auth would fail with 401.

Fix:

• Uncommented MUTINY_API_TOKEN=${MUTINY_API_TOKEN:?set MUTINY_API_TOKEN for non-loopback Hosted} — same required-set pattern as the api service.
• Uncommented MUTINY_API_URL=http://api:8000 — points to the Docker service name, not 127.0.0.1.

[vercel]

@slsgzs-cloud is attempting to deploy a commit to the priyanshu's projects Team on Vercel.

A member of the Team first needs to authorize it.

[CodewithJha]

Thanks @slsgzs-cloud — the core fix for #17 is right: uncommenting MUTINY_API_TOKEN / MUTINY_API_URL on web, and using the same ${MUTINY_API_TOKEN:?…} fail-closed pattern as api, is exactly what compose needs so the Next rewrite can auth against http://api:8000.

Holding merge for the rest of #17’s acceptance criteria (still open):

1. Short comment in compose above the web env vars explaining why both are required (token for Bearer injection in middleware; MUTINY_API_URL=http://api:8000 because 127.0.0.1 is wrong inside the container). The api block already hints at this — mirror that briefly on web.
2. Docs one-liner — docs/COLD_START.md already says set the same token on api and web; please also mention that compose sets MUTINY_API_URL=http://api:8000 for the web service (or equivalent hostname). README Hosted/compose mention is fine if you prefer that surface.

No other concerns: scoped to compose, no Hosted auth-model / customer-exec/FS changes, Vercel auth failure is unrelated and safe to ignore. I’ve approved the fork Actions run so unit CI can proceed — once the comment + docs line land and CI is green, happy to squash-merge.

[CodewithJha]

Friendly bump @slsgzs-cloud — still keen to land this once the two small #17 acceptance items from the earlier review are in:

1. Short comment above the web env vars in docker-compose.yml (why token + MUTINY_API_URL=http://api:8000 are required inside compose).
2. One docs line (docs/COLD_START.md or README Hosted/compose) noting compose sets MUTINY_API_URL=http://api:8000 for web.

The core uncomment + :? fail-closed pattern is already right; CI was green aside from the unrelated Vercel auth failure. Ping me when those land and I’ll squash-merge quickly.

If you’ve moved on, no worries — just leave a note and we can keep #17 open for another contributor. Either way, thanks for the fix so far — if you want another bite after this, browse open good first issue labels and comment on the issue first so nobody doubles up.

[CodewithJha]

Thanks @slsgzs-cloud — this hits #17 cleanly: web gets the same ${MUTINY_API_TOKEN:?…} fail-closed pattern as api, MUTINY_API_URL=http://api:8000 for in-compose rewrites, plus the short compose comment and COLD_START one-liner from acceptance. Unit CI green on 3.11/3.12 (plus cli-smoke / web-build / package-build); ignoring the Vercel auth failure (unrelated to this PR). Merging now.

[CodewithJha]

LGTM — #17 acceptance complete (compose comment + COLD_START MUTINY_API_URL note). Squash-merging.

[CodewithJha]

Merged — thank you @slsgzs-cloud. Exactly the kind of focused compose/DX fix Mutiny needs: web auth + in-network API URL aligned with the post–P0-1 Hosted token gate, documented so the next cold-start doesn’t hit a silent 401.

If you want another similar bite later:

• #46 — Windows / WSL FAQ bullets for uv + mutiny (docs, good first issue)
• or #38 — explain empty integrations/ vs Architecture diagram if you want another small docs clarification

Comment on the issue first so nobody doubles up — happy to review quickly once a PR lands. CONTRIBUTING: https://github.com/CodewithJha/mutiny/blob/main/CONTRIBUTING.md