From 359a0dccb6c25d5f184dd822cc6ccb200a641bad Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sat, 11 Jul 2026 22:13:47 +0100
Subject: [PATCH] remove domain fallback defaults - domain must be explicitly
 configured

---
 compose/stack.yaml |  2 ++
 tools/nextwks.sh   | 15 ++++++++++++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/compose/stack.yaml b/compose/stack.yaml
index 7b22959..09419fc 100644
--- a/compose/stack.yaml
+++ b/compose/stack.yaml
@@ -58,6 +58,8 @@ services:
     environment:
       - CONFIG_DIR=/opt/nextworkspace/config/nextworkspace
       - AUTHELIA_SECRET={AUTHELIA_SECRET}
+      - DOMAIN={DOMAIN}
+      - TLS_EMAIL={TLS_EMAIL}
     healthcheck:
       test: ["CMD", "curl", "-sf", "http://127.0.0.1:9000/health"]
       interval: 30s
diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index 1d1217f..471bdf8 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -43,7 +43,10 @@ elif [ -r "$TARGET_DIR/.env" ]; then
     set -a; source "$TARGET_DIR/.env"; set +a
 fi
 set -u
-DOMAIN="${DOMAIN:-nextwks.eu}"
+if [ -z "${DOMAIN:-}" ]; then
+    echo "ERROR: DOMAIN is not set. Configure it in /opt/backup/.env or run --install to set it up."
+    exit 1
+fi
 
 echo "=== NextWorkspace ${MODE} ==="
 
@@ -95,6 +98,12 @@ if [ "$MODE" = "install" ]; then
     read -p "TLS email (Let's Encrypt): " TLS_EMAIL
     while [ -z "$TLS_EMAIL" ]; do read -p "TLS email (required): " TLS_EMAIL; done
     while echo "$TLS_EMAIL" | grep -qv '@'; do read -p "Invalid email: " TLS_EMAIL; done
+
+    # Validate required configs
+    if [ -z "$TLS_EMAIL" ] || [ -z "$DOMAIN" ]; then
+        echo "ERROR: TLS_EMAIL and DOMAIN are required."
+        exit 1
+    fi
     read -p "Admin username: " ADMIN_USERNAME
     while [ -z "$ADMIN_USERNAME" ]; do read -p "Admin username (required): " ADMIN_USERNAME; done
     # 24 chars, mixed case + numbers, no special chars (safe for .env)
@@ -251,7 +260,7 @@ trap "rm -rf '$GEN_DIR'" EXIT
 echo "[*] Generating config files..."
 
 # Caddyfile
-sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
+sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|$TLS_EMAIL|g" \
     "$BUILD_DIR/config/caddy/Caddyfile" > "$GEN_DIR/Caddyfile"
 
 # Authelia config — preserve existing secrets if present
@@ -272,7 +281,7 @@ sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
         ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "$ADMIN_PASSWORD_HASH")
     fi
 sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
-    -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
+    -e "s|{TLS_EMAIL}|$TLS_EMAIL|g" \
     "$BUILD_DIR/config/authelia/users_database.yml" > "$GEN_DIR/users_database.yml"
 
 # Copy generated configs to target