v1.4.47.2 + .3 confirmed that the production APNs key arrives at process.env corrupted along the docker-compose env_file pipeline. Defensive PEM normalisation cannot recover it.
This release adds APNS_KEY_B64 — the operator base64-encodes the raw .p8 file (real newlines intact) and stores that single ASCII-safe blob. The app decodes back to a PEM string. No \n escape gymnastics, no character-class transformations along the way — base64 chars survive every env-var pipeline.
Precedence
APNS_KEY_B64 > APNS_KEY > APNS_KEY_FILE
Operator action
base64 -i AuthKey_<KEY_ID>.p8 | tr -d '\n'Paste the output as APNS_KEY_B64 in the Coolify env-var block. The legacy APNS_KEY can stay set or be removed; the B64 variant overrides it when present.
Risk
Zero. Additive — existing APNS_KEY consumers keep working unchanged. The new path has its own asymmetric-key verification + one-warning-per-process disable semantics from v1.4.47.2.