lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix bcrypt hash corruption: avoid bash -c re-expanding $ signs, auto-regenerate hash on update

Browse source
This commit is contained in:
Claus Lohmar 2026-07-11 09:16:14 +01:00
parent f0c6aa1a2e
commit 7303c94a3c
1 changed files with 9 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
tools/nextwks.sh
View file

@ -267,11 +267,10 @@ sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
-e "s|{SMTP_PASS}|$SMTP_PASS|g" \
"$BUILD_DIR/config/authelia/configuration.yml" > "$GEN_DIR/configuration.yml"
# Users database
ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ]; then
ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
fi
# Users database — regenerate hash if ADMIN_PASSWORD is available
if [ -n "${ADMIN_PASSWORD:-}" ]; then
ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "$ADMIN_PASSWORD_HASH")
fi
sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
-e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
"$BUILD_DIR/config/authelia/users_database.yml" > "$GEN_DIR/users_database.yml"
@ -285,11 +284,11 @@ maybe_sudo cp "$GEN_DIR/users_database.yml" "$TARGET_DIR/config/authelia/users_d
if [ -f "$BACKUP_DIR/.env" ]; then
maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^STORAGE_ENCRYPTION_KEY=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
fi
# Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
maybe_sudo bash -c "echo \"STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'\" >> '$BACKUP_DIR/.env'"
[ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
# Use pipe to avoid bash -c re-expanding $ signs (bcrypt hashes contain $2a$10$...)
echo "JWT_SECRET='$JWT_SECRET'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
echo "SESSION_SECRET='$SESSION_SECRET'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
echo "STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
[ -n "$ADMIN_PASSWORD_HASH" ] && echo "ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'" | maybe_sudo tee -a "$BACKUP_DIR/.env" >/dev/null
maybe_sudo chmod 600 "$BACKUP_DIR/.env"
# ============================================================