Separate HMAC key from read token

test/docker/docker-compose-stress.yaml

@@ -1,10 +1,12 @@
 # Docker Compose stress test with receiver
-# Run with: docker compose -f test/docker/docker-compose-stress.yaml up
+# See README.md "Docker Compose" section for the full token workflow.
 #
 # This test:
-# 1. Starts the metrics receiver
-# 2. Runs heavy CPU/memory workloads in multiple containers with shared PID namespace
-# 3. Collector gathers metrics and pushes summary to receiver on shutdown
+# 1. Starts the metrics receiver (with read-token and hmac-key)
+# 2. You generate a scoped push token via POST /api/v1/token
+# 3. Start the collector with COLLECTOR_PUSH_TOKEN set
+# 4. Runs heavy CPU/memory workloads in multiple containers with shared PID namespace
+# 5. Collector gathers metrics and pushes summary to receiver on shutdown
 #
 # To trigger the push, stop the collector gracefully:
 #   docker compose -f test/docker/docker-compose-stress.yaml stop collector
@@ -20,6 +22,8 @@ services:
       - "9080:8080"
     environment:
       - DB_PATH=/data/metrics.db
+      - RECEIVER_READ_TOKEN=dummyreadtoken
+      - RECEIVER_HMAC_KEY=dummyhmackey
     volumes:
       - receiver-data:/data
     healthcheck:
@@ -98,6 +102,8 @@ services:
       - --log-format=json
       - --push-endpoint=http://receiver:8080/api/v1/metrics
     environment:
+      # Push token — pass via COLLECTOR_PUSH_TOKEN from host env
+      COLLECTOR_PUSH_TOKEN: "${COLLECTOR_PUSH_TOKEN}"
       # Execution context for the receiver
       GITHUB_REPOSITORY_OWNER: "test-org"
       GITHUB_REPOSITORY: "test-org/stress-test"