lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

admin password: 24 hex chars instead of 12

Browse source
This commit is contained in:
Claus Lohmar 2026-07-11 09:00:08 +01:00
parent fc93201313
commit 336574571f
1 changed files with 21 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
tools/nextwks.sh
View file

@ -35,11 +35,14 @@ maybe_sudo() {
}
# --- Load existing env (if any), skip if unreadable ---
# Temporarily disable -u because .env may contain $ signs (bcrypt hashes)
set +u
if [ -r "$BACKUP_DIR/.env" ]; then
set -a; source "$BACKUP_DIR/.env"; set +a
elif [ -r "$TARGET_DIR/.env" ]; then
set -a; source "$TARGET_DIR/.env"; set +a
fi
set -u
DOMAIN="${DOMAIN:-nextwks.eu}"
echo "=== NextWorkspace ${MODE} ==="
@ -94,7 +97,7 @@ if [ "$MODE" = "install" ]; then
while echo "$TLS_EMAIL" | grep -qv '@'; do read -p "Invalid email: " TLS_EMAIL; done
read -p "Admin username: " ADMIN_USERNAME
while [ -z "$ADMIN_USERNAME" ]; do read -p "Admin username (required): " ADMIN_USERNAME; done
ADMIN_PASSWORD=$(openssl rand -hex 6)
ADMIN_PASSWORD=$(openssl rand -hex 12) # 24 chars, hex only (no special chars)
echo ""
echo "========================================"
@ -115,21 +118,21 @@ if [ "$MODE" = "install" ]; then
read -p "IMAP host [imap.openxchange.eu]: " IMAP_HOST; IMAP_HOST="${IMAP_HOST:-imap.openxchange.eu}"
read -p "IMAP port [993]: " IMAP_PORT; IMAP_PORT="${IMAP_PORT:-993}"
# Persist config to backup vault
# Persist config to backup vault (single-quote values to protect $ signs)
maybe_sudo mkdir -p "$BACKUP_DIR"
maybe_sudo bash -c "cat > '$BACKUP_DIR/.env' <<EOF
maybe_sudo sh -c "cat > '$BACKUP_DIR/.env' <<'ENVEOF'
# NextWorkspace Configuration — auto-generated by nextwks.sh --install
DOMAIN=$DOMAIN
TLS_EMAIL=$TLS_EMAIL
ADMIN_USERNAME=$ADMIN_USERNAME
ADMIN_PASSWORD=$ADMIN_PASSWORD
SMTP_HOST=$SMTP_HOST
SMTP_PORT=$SMTP_PORT
SMTP_USER=$SMTP_USER
SMTP_PASS=$SMTP_PASS
IMAP_HOST=$IMAP_HOST
IMAP_PORT=$IMAP_PORT
EOF"
DOMAIN='$DOMAIN'
TLS_EMAIL='$TLS_EMAIL'
ADMIN_USERNAME='$ADMIN_USERNAME'
ADMIN_PASSWORD='$ADMIN_PASSWORD'
SMTP_HOST='$SMTP_HOST'
SMTP_PORT='$SMTP_PORT'
SMTP_USER='$SMTP_USER'
SMTP_PASS='$SMTP_PASS'
IMAP_HOST='$IMAP_HOST'
IMAP_PORT='$IMAP_PORT'
ENVEOF"
maybe_sudo chmod 600 "$BACKUP_DIR/.env"
fi
@ -261,9 +264,10 @@ if [ "$MODE" != "update" ]; then
if [ -f "$BACKUP_DIR/.env" ]; then
maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
fi
maybe_sudo bash -c "echo 'JWT_SECRET=$JWT_SECRET' >> '$BACKUP_DIR/.env'"
maybe_sudo bash -c "echo 'SESSION_SECRET=$SESSION_SECRET' >> '$BACKUP_DIR/.env'"
[ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo 'ADMIN_PASSWORD_HASH=$ADMIN_PASSWORD_HASH' >> '$BACKUP_DIR/.env'"
# Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
[ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
maybe_sudo chmod 600 "$BACKUP_DIR/.env"
fi