Hi !
First of all, thank you both for your kind support. I really appreciate it.
Second of all, my issues are (almost) solved. The healthcheck is now running perfectly and the mobile app configuration worked.
As you suggested, I recreated the containers to avoid any possible code contamination (even if as I was using only “big fat die(var_dump());” on a copied file, I had not much of doubt about my ability to roll-back 
).
I also re-checked the gpg and jwt folders on the NAS and re-applied them to user 33 (as there is indeed no www-data user on my NAS) with
chown -R 33:33 /volume1/docker/passbolt-3.5.0/passbolt/jwt/
chown -R 33:33/volume1/docker/passbolt-3.5.0/passbolt/gpg/
However, instead of defining all docker Env variables with Synology User interface (which I usually do to avoid running root command on the entire NAS), I used a full docker-compose with entire configuration variables (putting it only as reference if needed):
version: '3.9'
services:
passbolt-3.5.0-mariadb-10.7.1:
container_name: passbolt-3.5.0-mariadb-10.7.1
image: mariadb:10.7.1
restart: unless-stopped
environment:
MYSQL_RANDOM_ROOT_PASSWORD: "true"
MYSQL_DATABASE: "passbolt"
MYSQL_USER: "passbolt"
MYSQL_PASSWORD: "PASSWORD"
volumes:
- /volume1/docker/passbolt-3.5.0/mysql/:/var/lib/mysql
ports:
- 3306:3306
passbolt-3.5.0:
container_name: passbolt-3.5.0
image: passbolt/passbolt:latest-ce
#Alternatively you can use rootless:
#image: passbolt/passbolt:latest-ce-non-root
restart: unless-stopped
depends_on:
- passbolt-3.5.0-mariadb-10.7.1
environment:
APP_FULL_BASE_URL: https://password.cap300.be
DATASOURCES_DEFAULT_HOST: "passbolt-3.5.0-mariadb-10.7.1"
DATASOURCES_DEFAULT_USERNAME: "passbolt"
DATASOURCES_DEFAULT_PASSWORD: "PASSWORD"
DATASOURCES_DEFAULT_DATABASE: "passbolt"
EMAIL_TRANSPORT_DEFAULT_HOST: "MY_MAIL_HOST"
EMAIL_TRANSPORT_DEFAULT_PORT: 587
EMAIL_TRANSPORT_DEFAULT_USERNAME: "MY_MAIL_USER"
EMAIL_TRANSPORT_DEFAULT_PASSWORD: "MY_MAIL_PASSWORD"
EMAIL_TRANSPORT_DEFAULT_TLS: "true"
PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED: "true"
PASSBOLT_PLUGINS_MOBILE_ENABLED: "true"
EMAIL_DEFAULT_FROM: "MY_MAIL_ALIAS"
PASSBOLT_KEY_EMAIL: "MY_PASSBOLT_KEY_MAIL"
PASSBOLT_KEY_NAME: "MY_KEY_NAME"
PASSBOLT_REGISTRATION_PUBLIC: "false"
PASSBOLT_SSL_FORCE: "true"
volumes:
- /volume1/docker/passbolt-3.5.0/passbolt/gpg/:/etc/passbolt/gpg
- /volume1/docker/passbolt-3.5.0/passbolt/jwt/:/etc/passbolt/jwt
command: ["/usr/bin/wait-for.sh", "-t", "0", " passbolt-3.5.0-mariadb-10.7.1:3306", "--", "/docker-entrypoint.sh"]
ports:
- 80:80
- 443:443
#Alternatively for non-root images:
# - 80:8080
# - 443:4433
volumes:
database_volume:
gpg_volume:
jwt_volume:
Doing so, the ENV variables are correctly picked up by the healthcheck script, which is now running fine.
I still have the following errors that I’ll need to solve :
[FAIL] The server OpenPGP key is not set
[HELP] Create a key, export it and add the fingerprint to config/passbolt.php
[HELP] See. https://www.passbolt.com/help/tech/install#toc_gpg
[PASS] The public key file is defined in config/passbolt.php and readable.
[PASS] The private key file is defined in config/passbolt.php and readable.
[FAIL] The server key fingerprint doesn't match the one defined in config/passbolt.php.
[HELP] Double check the key fingerprint, example:
[HELP] sudo su -s /bin/bash -c "gpg --list-keys --fingerprint --home /var/lib/passbolt/.gnupg" www-data | grep -i -B 2 'SERVER_KEY_EMAIL'
[HELP] SERVER_KEY_EMAIL: The email you used when you generated the server key.
[HELP] See. https://www.passbolt.com/help/tech/install#toc_gpg
[FAIL] The server public key defined in the config/passbolt.php (or environment variables) is not in the keyring
[HELP] Import the private server key in the keyring of the webserver user.
[HELP] you can try:
[HELP] sudo su -s /bin/bash -c "gpg --home /var/lib/passbolt/.gnupg --import /etc/passbolt/gpg/serverkey_private.asc" www-data
[FAIL] The server key does not have a valid email id.
[HELP] Edit or generate another key with a valid email id
I tried removing the keys (from inside the container and from the persistence folder on the NAS to rotate the key (as described here) but listing the keys with
gpg --list-keys --fingerprint --home /var/lib/passbolt/.gnupg
stills returns two keys (one ultimate and one unknown), which however are using the provided “PASSBOLT_KEY_EMAIL” and “PASSBOLT_KEY_NAME”.
Sorry for my extra long post and once again, thank you for your help, quick reactions and really great product.
Cheers 
). Thank you for looking into it with me.