From 20ef50e8e96fd702f105451ee1cb18e82665455b Mon Sep 17 00:00:00 2001
From: Daniel <danitex@danvics.com>
Date: Fri, 11 Sep 2026 02:29:55 +0200
Subject: [PATCH] fix: the hidden attribute now hides, and the gateway URL
 comes from the vault
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Retry loading settings" was permanently on screen even though the settings had
loaded fine. The browser's [hidden]{display:none} lives in the user agent
stylesheet, so any author rule setting display beats it — .btn-sm sets
display:inline-flex, so `<button hidden class="btn-sm btn-ghost">` never hid.
Earlier fixes bolted style="display:none" onto individual elements one at a
time; one [hidden]{display:none!important} covers all fourteen.

LITELLM_API_BASE is no longer pinned in Compose. Compose env wins over OpenBao,
so hardcoding http://litellm:4000 silently overrode the vault's
https://llm.danvics.com and the intended configuration had never taken effect.
The entrypoint now applies 28 secrets rather than 27, with 2 deliberate
overrides rather than 3. Transcription, text-to-speech and the signed-out
preview were all checked through the public gateway afterwards.

Worth recording since it was the reason for the change: this clears no network
dependency. ped-ai still needs danvics_mcp for mcp, the assets network for
MinIO, the openwebui network for LibreTranslate and danvics_monitoring for Loki;
none of those has a public route. It also adds about 20ms per call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
---
 docker-compose.yml    | 5 ++++-
 public/css/styles.css | 9 +++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 443ac490..281d3a01 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -17,7 +17,10 @@ services:
       CLINICAL_ASSISTANT_MCP_URL: http://mcp:8000/mcp
       REDIS_URL: redis://ped-ai-redis:6379
       LOKI_URL: http://monitoring-loki:3100
-      LITELLM_API_BASE: http://litellm:4000
+      # LITELLM_API_BASE is deliberately NOT set here. Compose env wins over
+      # OpenBao, so hardcoding the internal URL silently overrode the vault's
+      # https://llm.danvics.com and the intended config never took effect.
+      # Set it here only to pin ped-ai to the internal gateway on purpose.
       TTS_PROVIDER: litellm
       LITELLM_TTS_MODEL: local-kokoro-tts
       LITELLM_TTS_VOICE: sherpa/kokoro:am_adam
diff --git a/public/css/styles.css b/public/css/styles.css
index b9b73a8b..3873a5ad 100644
--- a/public/css/styles.css
+++ b/public/css/styles.css
@@ -1273,6 +1273,15 @@ textarea.full-input{resize:vertical;}
 body.assistant-workspace .announcement-banner { display:none; }
 body.assistant-workspace .app-body { min-height:100vh; }
 body.assistant-workspace #assistant-tab.active { width:100%; }
+/* The hidden attribute must actually hide.
+   The browser's own rule is [hidden]{display:none}, but that lives in the user
+   agent stylesheet, so ANY author rule setting display beats it — .btn-sm sets
+   display:inline-flex, so `<button hidden class="btn-sm">` stayed on screen.
+   That is why "Retry loading settings" was always visible even though the
+   settings had loaded fine. Previous fixes bolted style="display:none" onto
+   individual elements; this fixes every one of them at once. */
+[hidden] { display: none !important; }
+
 /* iOS: taps on controls must not trigger double-tap zoom */
 button, a, .btn-sm, .btn-generate, .btn-send, .tab-btn, input, textarea, select, label { touch-action: manipulation; }