e10f6bf9af
Setting JWT_SECRET via environment variable was broken by design: the admin panel rotation updates the in-memory binding and persists the new value to data/.jwt_secret, but an env var would silently override it on the next restart, reverting the rotation. The server now always loads JWT_SECRET from data/.jwt_secret (auto-generating it on first start), making the file the single source of truth. Rotation is handled exclusively through the admin panel. - config.ts: drop process.env.JWT_SECRET fallback and JWT_SECRET_IS_GENERATED export; always read from / write to data/.jwt_secret - index.ts: remove the now-obsolete JWT_SECRET startup warning - .env.example, docker-compose.yml, README: remove JWT_SECRET entries - Helm chart: remove JWT_SECRET from secretEnv, secret.yaml, and deployment.yaml; rename generateJwtSecret → generateEncryptionKey and update NOTES.txt and README accordingly
30 lines
1.0 KiB
YAML
30 lines
1.0 KiB
YAML
{{- if and (not .Values.existingSecret) (not .Values.generateEncryptionKey) }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "trek.fullname" . }}-secret
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
type: Opaque
|
|
data:
|
|
{{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ .Values.secretEnv.ENCRYPTION_KEY | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
{{- if and (not .Values.existingSecret) (.Values.generateEncryptionKey) }}
|
|
{{- $secretName := printf "%s-secret" (include "trek.fullname" .) }}
|
|
{{- $existingSecret := (lookup "v1" "Secret" .Release.Namespace $secretName) }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ $secretName }}
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
type: Opaque
|
|
stringData:
|
|
{{- if and $existingSecret $existingSecret.data }}
|
|
{{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec }}
|
|
{{- else }}
|
|
{{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 }}
|
|
{{- end }}
|
|
{{- end }}
|