lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add storage.encryption_key to Authelia config, fix certs directory

Browse source
This commit is contained in:
Claus Lohmar 2026-07-11 09:08:31 +01:00
parent 0dbb576d1b
commit 9ba62e4c8b
3 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
AGENT.md
View file

@ -67,7 +67,7 @@ Config files use `{PLACEHOLDER}` syntax. The script substitutes values at deploy
| File | Placeholders |
|------|-------------|
| `config/caddy/Caddyfile` | `{DOMAIN}`, `{TLS_EMAIL}` |
| `config/authelia/configuration.yml` | `{DOMAIN}`, `{JWT_SECRET}`, `{SESSION_SECRET}`, `{SMTP_HOST}`, `{SMTP_PORT}`, `{SMTP_USER}`, `{SMTP_PASS}` |
| `config/authelia/configuration.yml` | `{DOMAIN}`, `{JWT_SECRET}`, `{SESSION_SECRET}`, `{STORAGE_ENCRYPTION_KEY}`, `{SMTP_HOST}`, `{SMTP_PORT}`, `{SMTP_USER}`, `{SMTP_PASS}` |
| `config/authelia/users_database.yml` | `{ADMIN_PASSWORD_HASH}`, `{TLS_EMAIL}` |
| `compose/stack.yaml` | `{AUTHELIA_SECRET}` (same as `SESSION_SECRET`) |
@ -85,6 +85,7 @@ SMTP_USER=post@nextwks.eu
SMTP_PASS=<prompted>
JWT_SECRET=<auto-generated>
SESSION_SECRET=<auto-generated>
STORAGE_ENCRYPTION_KEY=<auto-generated>
ADMIN_PASSWORD_HASH=<bcrypt hash>
```

3
config/authelia/configuration.yml
View file

@ -9,8 +9,6 @@ log:
theme: dark
certificates_directory: /config/certs/
jwt_secret: {JWT_SECRET}
default_redirection_url: https://app.{DOMAIN}/
@ -115,6 +113,7 @@ regulation:
ban_time: 5m
storage:
encryption_key: {STORAGE_ENCRYPTION_KEY}
local:
path: /data/db.sqlite

5
tools/nextwks.sh
View file

@ -240,8 +240,10 @@ if [ "$MODE" != "update" ]; then
# Authelia config — preserve existing secrets if present
JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
STORAGE_ENCRYPTION_KEY="${STORAGE_ENCRYPTION_KEY:-$(openssl rand -hex 32)}"
sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
-e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
-e "s|{STORAGE_ENCRYPTION_KEY}|$STORAGE_ENCRYPTION_KEY|g" \
-e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
-e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
-e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
@ -264,11 +266,12 @@ if [ "$MODE" != "update" ]; then
# Persist generated secrets so --destroy is idempotent
if [ -f "$BACKUP_DIR/.env" ]; then
maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^STORAGE_ENCRYPTION_KEY=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
fi
# Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
maybe_sudo bash -c "echo \"STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'\" >> '$BACKUP_DIR/.env'"
[ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
maybe_sudo chmod 600 "$BACKUP_DIR/.env"
fi