Changeset 09ee2bd in Klonkt

Timestamp:

06/23/2026 09:25:42 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

f99bbe8

Parents:

45271b7

Message:

feat: auto-generate SESSION_SECRET if not set (zero-config Docker/manual)

If SESSION_SECRET is missing, generate a strong one on first boot and persist it
to <dataDir>/.session-secret (stable across restarts/updates). Env var still wins.
PUBLIC_BASE_URL already falls back to the request host. So Docker (B) and manual
(C) installs now run with no required .env editing. Docs + .env.example updated;
docker-compose comment translated to English.

Co-Authored-By: Claude <noreply@…>

Files:

• .env.example (modified) (1 diff)
• README.md (modified) (2 diffs)
• docker-compose.yml (modified) (1 diff)
• src/server.js (modified) (2 diffs)

.env.example

@@ -1 +1 @@
 NODE_ENV=development
 PORT=3000
-SESSION_SECRET=change-me-to-a-strong-random-string-min-32-chars
+# Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
+# one on first start (saved to storage/.session-secret, stays stable across
+# restarts/updates). Or set your own: openssl rand -hex 32
+SESSION_SECRET=
 DATABASE_PATH=./storage/database.sqlite
 MEDIA_PATH=./storage/media
 
-# Canonical public URL of this site (scheme + host, no path/slash). Used for
-# links in emails (password reset) instead of request headers — prevents
-# host-header spoofing. Not set? Then it falls back to the request host (dev).
-PUBLIC_BASE_URL=https://example.com
+# Canonical public URL of this site (scheme + host, no trailing slash), e.g.
+# https://yourdomain.com . Used to build correct links in emails (password reset)
+# and OAuth redirects instead of trusting request headers (anti-spoofing).
+# Optional: leave empty and it falls back to the request host (fine for local/dev);
+# set it for production so email/login links point at the right place.
+PUBLIC_BASE_URL=
 
 # ── Administrator ───────────────────────────────────────────────────

README.md

@@ -58 +58 @@
 git clone https://github.com/roboburr/klonkt.git
 cd klonkt
-cp .env.example .env          # then edit .env: set SESSION_SECRET + PUBLIC_BASE_URL
+cp .env.example .env          # works as-is; optionally set PUBLIC_BASE_URL to your domain
 docker compose up -d
 ```
 
+`SESSION_SECRET` is auto-generated on first start, so the defaults work as-is.
 Klonkt runs on port 3000 — put your own reverse proxy in front for HTTPS (see
 step 5 of Option C). Data (database + media) stays in the `klonkt-data` volume,
@@ -79 +80 @@
 ```
 
-**2. Create your config** — copy the example and edit it; at minimum set a long
-random `SESSION_SECRET` and your `PUBLIC_BASE_URL` (e.g. `https://yourdomain.com`):
+**2. Create your config.** `SESSION_SECRET` (the key that signs login cookies) is
+auto-generated on first start, so this works as-is. For production, set
+`PUBLIC_BASE_URL` to your site address (e.g. `https://yourdomain.com`) so email &
+login links are correct:
 
 ```bash
 cp .env.example .env
-nano .env
+nano .env          # optional: PUBLIC_BASE_URL, plus SMTP / Google if you want them
 ```
 

docker-compose.yml

@@ -1 @@
-# Klonkt — zelf-host met Docker Compose.
+# Klonkt — self-host with Docker Compose.
 #
-#   1. cp .env.example .env   en vul SESSION_SECRET + PUBLIC_BASE_URL in
+#   1. cp .env.example .env     (works as-is: SESSION_SECRET is auto-generated;
+#                                optionally set PUBLIC_BASE_URL to your domain so
+#                                email/login links are correct)
 #   2. docker compose up -d
-#   3. open je site en maak via /auth/register je beheerdersaccount aan
+#   3. open your site and create your admin account at /auth/register
 #
-# Standaard luistert de app op poort 3000. Zet er een reverse-proxy (Caddy/
-# nginx) vóór voor HTTPS op je domein — zie README.
+# The app listens on port 3000. Put a reverse proxy (Caddy/nginx) in front for
+# HTTPS on your domain — see README.
 services:
   klonkt:

src/server.js

@@ -13 +13 @@
 import path from 'path';
 import fs from 'fs';
+import crypto from 'crypto';
 import { fileURLToPath } from 'url';
 import http from 'http';
@@ -63 +64 @@
 import changelogRoutes from './routes/changelog.js';
 
+// SESSION_SECRET: use the env var if set. Otherwise auto-generate a strong one
+// and persist it next to the database, so it stays stable across restarts and
+// updates. This lets Docker / bare-Node installs run with zero manual config.
 if (!process.env.SESSION_SECRET) {
-  console.error('❌ FATAL: SESSION_SECRET is required');
-  process.exit(1);
+  const dataDir = path.dirname(process.env.DATABASE_PATH || './storage/database.sqlite');
+  const secretFile = path.join(dataDir, '.session-secret');
+  try { process.env.SESSION_SECRET = fs.readFileSync(secretFile, 'utf8').trim(); } catch { /* not yet generated */ }
+  if (!process.env.SESSION_SECRET) {
+    fs.mkdirSync(dataDir, { recursive: true });
+    process.env.SESSION_SECRET = crypto.randomBytes(32).toString('hex');
+    fs.writeFileSync(secretFile, process.env.SESSION_SECRET, { mode: 0o600 });
+    console.log(`🔑 Generated a SESSION_SECRET (stored in ${secretFile})`);
+  }
 }
 
+// A SESSION_SECRET that was explicitly set in the env must still be strong in prod.
 if (process.env.NODE_ENV === 'production' && process.env.SESSION_SECRET.length < 32) {
-  console.error('❌ FATAL: SESSION_SECRET too weak for production');
+  console.error('❌ FATAL: SESSION_SECRET is too weak for production (set a longer, random one in .env)');
   process.exit(1);
 }