diff --git a/docs/guide/upgrade-notes.md b/docs/guide/upgrade-notes.md index 555c10b..ccd3268 100644 --- a/docs/guide/upgrade-notes.md +++ b/docs/guide/upgrade-notes.md @@ -156,13 +156,23 @@ initialised with. That is the same desync the old mechanism caused on every reinstall; the difference is that it now happens at most once, because the values are preserved from then on. -### Database password keys are now numbered slots +### Every generated secret is now a numbered slot -`CFG__DB_PASSWORD` became `CFG__DB_PASSWORD_1`, and -`CFG__DB_ROOT_PASSWORD` became `CFG__DB_ROOT_PASSWORD_1`, so a database -credential is always a numbered slot and an app that needs a second one just adds -`_2`. This also touches **nextcloud** and **bookstack**, which were otherwise -unaffected by the change above. +The convention is now uniform: **if a config key holds a generated value, its name +ends in a slot number.** `CFG__DB_PASSWORD` became +`CFG__DB_PASSWORD_1`, `CFG_TRAEFIK_ADMIN_PASSWORD` became +`CFG_TRAEFIK_ADMIN_PASSWORD_1`, and so on — 42 keys across the catalog. An app +that needs a second credential of the same kind just adds `_2`; nothing has to be +registered, because the tag name is derived from the key. + +Keys holding a value you chose rather than one the installer generated (say +`CFG_NEXTCLOUD_ADMIN_USER=admin`) are unchanged — the slot number is what marks a +value as generated. + +This reaches apps that had nothing to do with the compose-side generator problem +above, including **adguard, authelia, bookstack, gitea, gluetun, headscale, +invidious, moneyapp, nextcloud, pihole, speedtest, stalwart, traefik, vaultwarden** +and **wireguard**. A rename is a delete plus an add as far as config reconciliation is concerned: the old key is dropped and the new one arrives holding its `RANDOMIZED*` placeholder, @@ -172,10 +182,14 @@ reinstalling — reconciliation leaves the previous file as a hidden `..config.bak` sibling, so the old value is still there: ```bash -grep DB_PASSWORD //..config.bak +grep -E '=RANDOMIZED|PASSWORD|SECRET|TOKEN|KEY' //..config.bak ``` Paste each value into the matching `_1` key in `//.config`. +For a Nextcloud install that means `CFG_NEXTCLOUD_ADMIN_PASSWORD_1`, +`CFG_NEXTCLOUD_DB_PASSWORD_1` and `CFG_NEXTCLOUD_DB_ROOT_PASSWORD_1` — the two +database ones are the pair that matters, because MariaDB will keep rejecting a +regenerated password. ### Mastodon web push diff --git a/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh b/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh index c3f437b..3eb0d67 100755 --- a/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh +++ b/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh @@ -462,6 +462,96 @@ PORTEOF "tooltip": "Object store root password (auto-generated), shared by MinIO and the bucket-creation job.", "advanced": true }, + "ADGUARD_ADMIN_PASSWORD_1": { + "category": "general", + "label": "AdGuard Admin Password", + "type": "password", + "tooltip": "Password for the AdGuard Home admin account (auto-generated; persists across reinstalls)" + }, + "GITEA_ADMIN_PASSWORD_1": { + "category": "general", + "label": "Gitea Admin Password", + "type": "password", + "tooltip": "Password for the Gitea administrator account (auto-generated; persists across reinstalls)" + }, + "GITEA_METRICS_TOKEN_1": { + "category": "advanced", + "label": "Metrics Token", + "type": "password", + "tooltip": "Bearer token Prometheus uses to scrape Gitea's metrics endpoint (auto-generated)", + "advanced": true + }, + "HEADSCALE_BASIC_AUTH_PASS_1": { + "category": "general", + "label": "Basic Auth Password", + "type": "password", + "tooltip": "Password protecting the Headscale endpoint (auto-generated; persists across reinstalls)" + }, + "INVIDIOUS_ADMIN_PASSWORD_1": { + "category": "general", + "label": "Invidious Admin Password", + "type": "password", + "tooltip": "Password for the Invidious administrator account (auto-generated; persists across reinstalls)" + }, + "INVIDIOUS_HMAC_KEY_1": { + "category": "advanced", + "label": "HMAC Key", + "type": "password", + "tooltip": "Signs Invidious session tokens (auto-generated). Changing it logs every user out.", + "advanced": true + }, + "MATRIX_ADMIN_PASSWORD_1": { + "category": "general", + "label": "Matrix Admin Password", + "type": "password", + "tooltip": "Password for the first Synapse admin account, created on install (auto-generated)" + }, + "MONEYAPP_AUTH_SECRET_1": { + "category": "advanced", + "label": "Auth Secret", + "type": "password", + "tooltip": "Signs session tokens (auto-generated). Changing it logs every user out.", + "advanced": true + }, + "STALWART_ADMIN_PASSWORD_1": { + "category": "general", + "label": "Stalwart Admin Password", + "type": "password", + "tooltip": "Password for the Stalwart administrator account (auto-generated; persists across reinstalls)" + }, + "STALWART_FIRST_MAILBOX_PASSWORD_1": { + "category": "general", + "label": "First Mailbox Password", + "type": "password", + "tooltip": "Password for the mailbox created on install (auto-generated; persists across reinstalls)" + }, + "TRAEFIK_ADMIN_PASSWORD_1": { + "category": "general", + "label": "Traefik Admin Password", + "type": "password", + "tooltip": "Password for the Traefik dashboard account (auto-generated; persists across reinstalls)" + }, + "BOOKSTACK_APP_KEY_1": { + "category": "advanced", + "label": "Application Key", + "type": "password", + "tooltip": "Laravel APP_KEY — encrypts session data (auto-generated). Changing it invalidates existing sessions.", + "advanced": true + }, + "BOOKSTACK_DB_PASSWORD_1": { + "category": "advanced", + "label": "Database Password", + "type": "password", + "tooltip": "MariaDB password for the BookStack user (auto-generated; persists across reinstalls)", + "advanced": true + }, + "BOOKSTACK_DB_ROOT_PASSWORD_1": { + "category": "advanced", + "label": "Database Root Password", + "type": "password", + "tooltip": "MariaDB root password (auto-generated; kept separate from the app user password)", + "advanced": true + }, "VAULTWARDEN_ADMIN_TOKEN_1": { "category": "general", "label": "Vaultwarden Admin Token",