From f0c6aa1a2e8850f45b00a64c2986358b42c00edb Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sat, 11 Jul 2026 09:13:22 +0100
Subject: [PATCH] always regenerate configs on --update too (picks up template
 changes like storage.encryption_key)

---
 tools/nextwks.sh | 80 +++++++++++++++++++++++-------------------------
 1 file changed, 39 insertions(+), 41 deletions(-)

diff --git a/tools/nextwks.sh b/tools/nextwks.sh
index f6296a0..5da96cb 100755
--- a/tools/nextwks.sh
+++ b/tools/nextwks.sh
@@ -248,51 +248,49 @@ fi
 GEN_DIR=$(mktemp -d)
 trap "rm -rf '$GEN_DIR'" EXIT
 
-if [ "$MODE" != "update" ]; then
-    echo "[*] Generating config files..."
+echo "[*] Generating config files..."
 
-    # Caddyfile
-    sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
-        "$BUILD_DIR/config/caddy/Caddyfile" > "$GEN_DIR/Caddyfile"
+# Caddyfile
+sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
+    "$BUILD_DIR/config/caddy/Caddyfile" > "$GEN_DIR/Caddyfile"
 
-    # Authelia config — preserve existing secrets if present
-    JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
-    SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
-    STORAGE_ENCRYPTION_KEY="${STORAGE_ENCRYPTION_KEY:-$(openssl rand -hex 32)}"
-    sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
-        -e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
-        -e "s|{STORAGE_ENCRYPTION_KEY}|$STORAGE_ENCRYPTION_KEY|g" \
-        -e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
-        -e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
-        -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
-        -e "s|{SMTP_PASS}|$SMTP_PASS|g" \
-        "$BUILD_DIR/config/authelia/configuration.yml" > "$GEN_DIR/configuration.yml"
+# Authelia config — preserve existing secrets if present
+JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
+SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
+STORAGE_ENCRYPTION_KEY="${STORAGE_ENCRYPTION_KEY:-$(openssl rand -hex 32)}"
+sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
+    -e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
+    -e "s|{STORAGE_ENCRYPTION_KEY}|$STORAGE_ENCRYPTION_KEY|g" \
+    -e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
+    -e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
+    -e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
+    -e "s|{SMTP_PASS}|$SMTP_PASS|g" \
+    "$BUILD_DIR/config/authelia/configuration.yml" > "$GEN_DIR/configuration.yml"
 
-    # Users database
-    ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
-    if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ]; then
-        ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
-    fi
-    sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
-        -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
-        "$BUILD_DIR/config/authelia/users_database.yml" > "$GEN_DIR/users_database.yml"
-
-    # Copy generated configs to target
-    maybe_sudo cp "$GEN_DIR/Caddyfile" "$TARGET_DIR/config/caddy/Caddyfile"
-    maybe_sudo cp "$GEN_DIR/configuration.yml" "$TARGET_DIR/config/authelia/configuration.yml"
-    maybe_sudo cp "$GEN_DIR/users_database.yml" "$TARGET_DIR/config/authelia/users_database.yml"
-
-    # Persist generated secrets so --destroy is idempotent
-    if [ -f "$BACKUP_DIR/.env" ]; then
-        maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^STORAGE_ENCRYPTION_KEY=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
-    fi
-    # Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
-    maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
-    maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
-    maybe_sudo bash -c "echo \"STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'\" >> '$BACKUP_DIR/.env'"
-    [ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
-    maybe_sudo chmod 600 "$BACKUP_DIR/.env"
+# Users database
+ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
+if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ]; then
+    ADMIN_PASSWORD_HASH=$(cd "$BUILD_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
 fi
+sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
+    -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
+    "$BUILD_DIR/config/authelia/users_database.yml" > "$GEN_DIR/users_database.yml"
+
+# Copy generated configs to target
+maybe_sudo cp "$GEN_DIR/Caddyfile" "$TARGET_DIR/config/caddy/Caddyfile"
+maybe_sudo cp "$GEN_DIR/configuration.yml" "$TARGET_DIR/config/authelia/configuration.yml"
+maybe_sudo cp "$GEN_DIR/users_database.yml" "$TARGET_DIR/config/authelia/users_database.yml"
+
+# Persist generated secrets so --destroy is idempotent
+if [ -f "$BACKUP_DIR/.env" ]; then
+    maybe_sudo sed -i "/^JWT_SECRET=/d; /^SESSION_SECRET=/d; /^STORAGE_ENCRYPTION_KEY=/d; /^ADMIN_PASSWORD_HASH=/d" "$BACKUP_DIR/.env" 2>/dev/null || true
+fi
+# Quote values to protect $ signs (bcrypt hashes, etc.) when sourcing
+maybe_sudo bash -c "echo \"JWT_SECRET='$JWT_SECRET'\" >> '$BACKUP_DIR/.env'"
+maybe_sudo bash -c "echo \"SESSION_SECRET='$SESSION_SECRET'\" >> '$BACKUP_DIR/.env'"
+maybe_sudo bash -c "echo \"STORAGE_ENCRYPTION_KEY='$STORAGE_ENCRYPTION_KEY'\" >> '$BACKUP_DIR/.env'"
+[ -n "$ADMIN_PASSWORD_HASH" ] && maybe_sudo bash -c "echo \"ADMIN_PASSWORD_HASH='$ADMIN_PASSWORD_HASH'\" >> '$BACKUP_DIR/.env'"
+maybe_sudo chmod 600 "$BACKUP_DIR/.env"
 
 # ============================================================
 # 10. FIX OWNERSHIP — all files in TARGET_DIR/BACKUP_DIR to user