Salastil
c851f11cea
The key used to be a fresh randomBytes() on every process start, by design — but that means every restart invalidates whatever's saved in a password manager or bookmarked admin session. Now it's generated once and written to backend/.env (ADMIN_API_KEY=...) on first launch, then read back from there on every later launch. An explicit ADMIN_API_KEY env var still wins outright, for Docker deployments that have no writable .env inside the container — wired an optional pass-through into both compose files for that case, since without it they'd keep regenerating on every recreate regardless of this change. Updated the handful of comments (server.ts, widgets/install.ts, index.ts's startup banner, .env.example) that documented the old every-restart-regenerates behavior as a load-bearing security property.
22 lines
1.1 KiB
Bash
22 lines
1.1 KiB
Bash
PORT=4000
|
|
FRONTEND_ORIGIN=http://localhost:5173
|
|
DB_PATH=./data/homefeed.db
|
|
MEDIA_DIR=./data/media
|
|
|
|
# There's no admin username/password to configure here — the backend generates a
|
|
# random API key on first launch, prints it to the console, and persists it to this
|
|
# .env file (as ADMIN_API_KEY) so it stays the same across restarts. Copy it into the
|
|
# admin login page (every /api/admin/* request requires it as an X-Api-Key header).
|
|
# Delete the ADMIN_API_KEY line below to force a new one on next launch, or set it
|
|
# explicitly yourself (e.g. in Docker, where there's no .env file to write back to).
|
|
# ADMIN_API_KEY=
|
|
|
|
NODE_ENV=development
|
|
|
|
# Optional — unlocks "private" categories (marked in the admin panel's Category
|
|
# priority list) for visitors who log in with this password on the public site's
|
|
# lock icon. Leave unset to disable private categories entirely (they stay hidden
|
|
# from everyone, with no way to unlock them). Unlike the admin API key above, this
|
|
# is a fixed password you choose, and the resulting login persists across restarts.
|
|
# PRIVATE_ACCESS_PASSWORD=
|