fix(anythingllm): inject required OPENROUTER_API_KEY into container env

The compose files documented OPENROUTER_API_KEY as a required Infisical
secret, but the environment block only injected JWT_SECRET and ADMIN_EMAIL
— the original Helm chart mounted all three. A redeploy/restore came up with
no OpenRouter credential in the container env; for the INT-S004 restore
specifically AnythingLLM would fall back to the expired key persisted in the
restored storage/.env, breaking inference with an opaque OpenRouter 401.

- Add fail-loud `${OPENROUTER_API_KEY:?...}` injection (same pattern as the
  JWT_SECRET guard) to the template and both live sites (s004.ccc.bot,
  ai.weown.agency). A value injected via `infisical run` now overrides the
  stale persisted key.
- Default OPENROUTER_MODEL_PREF (`:-anthropic/claude-opus-4.5` in sites,
  `{{ openrouter_model_pref }}` in the template) to silence the Compose
  "variable is not set" warning.

Validated: template re-renders byte-identical to the s004.ccc.bot site;
`docker compose config` resolves the key and defaults, and hard-fails with
the guard message when the key is absent.

Caught by Copilot review on PR #39.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ncimino

CHANGELOG.md

@@ -60,6 +60,7 @@ Changes in this section will be promoted to a dated release entry on merge to `m
 
 ### Fixed
 
+- **`OPENROUTER_API_KEY` never injected into the AnythingLLM container across `anythingllm-docker` (2026-06-02)** — the compose files documented `OPENROUTER_API_KEY` as a required Infisical secret, but the `environment:` block only injected `JWT_SECRET` and `ADMIN_EMAIL` (the original Helm chart mounted all three). A redeploy/restore therefore came up with no OpenRouter credential in the container env — and for the INT-S004 restore specifically, AnythingLLM would fall back to the **expired** key persisted in the restored `storage/.env`, breaking inference with an opaque OpenRouter 401. Added a fail-loud `${OPENROUTER_API_KEY:?...}` injection (same pattern as the `JWT_SECRET` guard) to the template (`compose.prod.yaml.jinja`) and both live sites (`s004.ccc.bot`, `ai.weown.agency`); a value injected via `infisical run` now correctly overrides the stale persisted key. Also gave `OPENROUTER_MODEL_PREF` a default (`${OPENROUTER_MODEL_PREF:-anthropic/claude-opus-4.5}` in the sites, `{{ openrouter_model_pref }}` in the template) to silence the Compose "variable is not set" warning. Caught by Copilot review on PR #39.
 - **`otel-agent/deploy.yml` broken Jinja escaping (2026-05-23)** — the file is a plain Ansible playbook (not a copier template), but it had been written with `{{ '{{' }} otel_agent_dir {{ '}}' }}` patterns that would render as the literal string `{{ otel_agent_dir }}` and prevent Ansible variable substitution. Replaced with plain `{{ otel_agent_dir }}` throughout.
 
 <!-- ── older 2026-05-14 batch (Added / Changed / Fixed continued) ── -->

anythingllm-docker/sites/ai.weown.agency/docker/compose.prod.yaml

@@ -21,7 +21,15 @@ services:
       STORAGE_DIR: "/app/server/storage"
       # LLM Configuration
       LLM_PROVIDER: "openrouter"
-      OPENROUTER_MODEL_PREF: "${OPENROUTER_MODEL_PREF}"
+      # Fail loud: OpenRouter is the only wired-in provider (LLM_PROVIDER above),
+      # so the API key is required. A bare `docker compose up` outside
+      # `infisical run` would inject an empty value, which overrides any key in
+      # AnythingLLM's persisted storage/.env (dotenv won't re-override a set var)
+      # and breaks inference with an opaque OpenRouter 401. `:?` makes compose
+      # refuse to start instead. The original Helm deployment mounted this as a
+      # required secret env var too.
+      OPENROUTER_API_KEY: "${OPENROUTER_API_KEY:?refusing to start: OPENROUTER_API_KEY not injected — start via 'infisical run'}"
+      OPENROUTER_MODEL_PREF: "${OPENROUTER_MODEL_PREF:-anthropic/claude-opus-4.5}"
       OPENROUTER_TIMEOUT_MS: "${OPENROUTER_TIMEOUT_MS:-3000}"
       # Vector Database (embedded LanceDB)
       VECTOR_DB: "lancedb"

anythingllm-docker/sites/s004.ccc.bot/docker/compose.prod.yaml

@@ -21,7 +21,15 @@ services:
       STORAGE_DIR: "/app/server/storage"
       # LLM Configuration
       LLM_PROVIDER: "openrouter"
-      OPENROUTER_MODEL_PREF: "${OPENROUTER_MODEL_PREF}"
+      # Fail loud: OpenRouter is the only wired-in provider (LLM_PROVIDER above),
+      # so the API key is required. A bare `docker compose up` outside
+      # `infisical run` would inject an empty value, which overrides any key in
+      # AnythingLLM's persisted storage/.env (dotenv won't re-override a set var)
+      # and breaks inference with an opaque OpenRouter 401. `:?` makes compose
+      # refuse to start instead. The original Helm deployment mounted this as a
+      # required secret env var too.
+      OPENROUTER_API_KEY: "${OPENROUTER_API_KEY:?refusing to start: OPENROUTER_API_KEY not injected — start via 'infisical run'}"
+      OPENROUTER_MODEL_PREF: "${OPENROUTER_MODEL_PREF:-anthropic/claude-opus-4.5}"
       OPENROUTER_TIMEOUT_MS: "${OPENROUTER_TIMEOUT_MS:-3000}"
       # Vector Database (embedded LanceDB)
       VECTOR_DB: "lancedb"

anythingllm-docker/template/docker/compose.prod.yaml.jinja

@@ -21,7 +21,15 @@ services:
       STORAGE_DIR: "/app/server/storage"
       # LLM Configuration
       LLM_PROVIDER: "{{ llm_provider }}"
-      OPENROUTER_MODEL_PREF: "${OPENROUTER_MODEL_PREF}"
+      # Fail loud: OpenRouter is the only wired-in provider (LLM_PROVIDER above),
+      # so the API key is required. A bare `docker compose up` outside
+      # `infisical run` would inject an empty value, which overrides any key in
+      # AnythingLLM's persisted storage/.env (dotenv won't re-override a set var)
+      # and breaks inference with an opaque OpenRouter 401. `:?` makes compose
+      # refuse to start instead. The original Helm deployment mounted this as a
+      # required secret env var too.
+      OPENROUTER_API_KEY: "${OPENROUTER_API_KEY:?refusing to start: OPENROUTER_API_KEY not injected — start via 'infisical run'}"
+      OPENROUTER_MODEL_PREF: "${OPENROUTER_MODEL_PREF:-{{ openrouter_model_pref }}}"
       OPENROUTER_TIMEOUT_MS: "${OPENROUTER_TIMEOUT_MS:-3000}"
       # Vector Database (embedded LanceDB)
       VECTOR_DB: "{{ vector_db }}"