From e8a2aa453ea35f84c53caab1d06c6245a3418380 Mon Sep 17 00:00:00 2001 From: librelad Date: Tue, 18 Aug 2026 20:55:52 +0100 Subject: [PATCH] fix(auth): resolve slot-numbered credential keys, drop two dead ones MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only two of the four keys flagged as unused actually were. gitea and invidious ADMIN_PASSWORD are written by their auth adapters through authPersistCfg, which builds the name as CFG_${app^^}_${key} from a parameter — invisible to a literal grep, which is why the earlier pass called them dead. They stay. Worse, the slot rename broke that write path for five apps: adguard, bookstack, gitea, invidious and nextcloud all persist ADMIN_PASSWORD, and the config now holds ADMIN_PASSWORD_1. updateConfigOption only rewrites a key that already exists, so the write became a no-op — the app's password would really change while the config and the WebUI kept showing the old one. authPersistCfg now falls back to the numbered slot when the bare key is absent, so adapters never need to know how a credential is numbered and adding a slot can't silently disconnect the adapter that writes it. When neither name exists it warns and returns non-zero instead of failing silently, which surfaces a pre-existing case: linkding's adapter persists ADMIN_USER and ADMIN_PASSWORD but its config declares neither, and never did. Deleted the two that really are dead: CFG_TRAEFIK_ADMIN_PASSWORD_1 (its adapter uses CFG_TRAEFIK_USER/CFG_TRAEFIK_PASS from the system config) and CFG_GLUETUN_CONTROL_SERVER_API_KEY_1, plus their WebUI field mappings. Co-Authored-By: Claude Opus 5 --- containers/gluetun/gluetun.config | 1 - containers/stoat/scripts/stoat_install_hooks.sh | 2 +- containers/traefik/traefik.config | 1 - docs/guide/upgrade-notes.md | 4 ++-- .../categories/webui_create_app_field_mappings.sh | 12 ------------ 5 files changed, 3 insertions(+), 17 deletions(-) diff --git a/containers/gluetun/gluetun.config b/containers/gluetun/gluetun.config index 3360ae4..c39a4c7 100644 --- a/containers/gluetun/gluetun.config +++ b/containers/gluetun/gluetun.config @@ -40,7 +40,6 @@ CFG_GLUETUN_OPENVPN_USER= CFG_GLUETUN_OPENVPN_PASSWORD= CFG_GLUETUN_WIREGUARD_PRIVATE_KEY= CFG_GLUETUN_WIREGUARD_ADDRESSES= -CFG_GLUETUN_CONTROL_SERVER_API_KEY_1=RANDOMIZEDPASSWORD1 # HEALTH_TARGETS = comma-separated host:port list pinged over HTTPS to # confirm the VPN tunnel is healthy. Defaults are privacy-respecting # (Mullvad — your VPN provider; EFF — privacy non-profit). Override diff --git a/containers/stoat/scripts/stoat_install_hooks.sh b/containers/stoat/scripts/stoat_install_hooks.sh index c52f27a..ad2d160 100644 --- a/containers/stoat/scripts/stoat_install_hooks.sh +++ b/containers/stoat/scripts/stoat_install_hooks.sh @@ -78,7 +78,7 @@ _stoatBaseUrl() # would create directories in their place) and again once the port is known. _stoatWriteUrlFiles() { - local app_dir="$1" base="$2" video_enabled="$3" + local app_dir="$1" base="$2" video_enabled="$3" rabbit_pass="$4" # ws:// for http, wss:// for https — a wss:// URL on a plain-HTTP origin # fails to connect and the client hangs on "connecting". diff --git a/containers/traefik/traefik.config b/containers/traefik/traefik.config index c3fe2b1..03b4c36 100755 --- a/containers/traefik/traefik.config +++ b/containers/traefik/traefik.config @@ -88,4 +88,3 @@ CFG_TRAEFIK_PORT_3="traefik-service|http|80:80|disabled|tcp|false|false|false|HT # AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user) CFG_TRAEFIK_AUTH_PROFILE=single_password CFG_TRAEFIK_ADMIN_USER= -CFG_TRAEFIK_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD1 diff --git a/docs/guide/upgrade-notes.md b/docs/guide/upgrade-notes.md index ccd3268..163cb56 100644 --- a/docs/guide/upgrade-notes.md +++ b/docs/guide/upgrade-notes.md @@ -160,8 +160,8 @@ are preserved from then on. The convention is now uniform: **if a config key holds a generated value, its name ends in a slot number.** `CFG__DB_PASSWORD` became -`CFG__DB_PASSWORD_1`, `CFG_TRAEFIK_ADMIN_PASSWORD` became -`CFG_TRAEFIK_ADMIN_PASSWORD_1`, and so on — 42 keys across the catalog. An app +`CFG__DB_PASSWORD_1`, `CFG_GITEA_ADMIN_PASSWORD` became +`CFG_GITEA_ADMIN_PASSWORD_1`, and so on — 40 keys across the catalog. An app that needs a second credential of the same kind just adds `_2`; nothing has to be registered, because the tag name is derived from the key. diff --git a/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh b/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh index 118dad8..e296b31 100755 --- a/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh +++ b/scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh @@ -525,12 +525,6 @@ PORTEOF "type": "password", "tooltip": "Password for the mailbox created on install" }, - "TRAEFIK_ADMIN_PASSWORD_1": { - "category": "general", - "label": "Traefik Admin Password", - "type": "password", - "tooltip": "Traefik dashboard password (auto-generated)" - }, "BOOKSTACK_APP_KEY_1": { "category": "advanced", "label": "Application Key", @@ -604,12 +598,6 @@ PORTEOF "type": "password", "tooltip": "Password for the seeded Authelia admin account" }, - "GLUETUN_CONTROL_SERVER_API_KEY_1": { - "category": "general", - "label": "Control Server API Key", - "type": "password", - "tooltip": "API key for the gluetun HTTP control server (blank disables auth)" - }, "GLUETUN_VPN_SERVICE_PROVIDER": { "category": "general", "label": "VPN Provider",