Changeset 09ee2bd in Klonkt for .env.example

Timestamp:

06/23/2026 09:25:42 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

f99bbe8

Parents:

45271b7

Message:

feat: auto-generate SESSION_SECRET if not set (zero-config Docker/manual)

If SESSION_SECRET is missing, generate a strong one on first boot and persist it
to <dataDir>/.session-secret (stable across restarts/updates). Env var still wins.
PUBLIC_BASE_URL already falls back to the request host. So Docker (B) and manual
(C) installs now run with no required .env editing. Docs + .env.example updated;
docker-compose comment translated to English.

Co-Authored-By: Claude <noreply@…>

File:

• .env.example (modified) (1 diff)

.env.example

@@ -1 +1 @@
 NODE_ENV=development
 PORT=3000
-SESSION_SECRET=change-me-to-a-strong-random-string-min-32-chars
+# Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
+# one on first start (saved to storage/.session-secret, stays stable across
+# restarts/updates). Or set your own: openssl rand -hex 32
+SESSION_SECRET=
 DATABASE_PATH=./storage/database.sqlite
 MEDIA_PATH=./storage/media
 
-# Canonical public URL of this site (scheme + host, no path/slash). Used for
-# links in emails (password reset) instead of request headers — prevents
-# host-header spoofing. Not set? Then it falls back to the request host (dev).
-PUBLIC_BASE_URL=https://example.com
+# Canonical public URL of this site (scheme + host, no trailing slash), e.g.
+# https://yourdomain.com . Used to build correct links in emails (password reset)
+# and OAuth redirects instead of trusting request headers (anti-spoofing).
+# Optional: leave empty and it falls back to the request host (fine for local/dev);
+# set it for production so email/login links point at the right place.
+PUBLIC_BASE_URL=
 
 # ── Administrator ───────────────────────────────────────────────────