containers/gluetun/gluetun.config

@@ -40,6 +40,7 @@ CFG_GLUETUN_OPENVPN_USER=
 CFG_GLUETUN_OPENVPN_PASSWORD=
 CFG_GLUETUN_WIREGUARD_PRIVATE_KEY=
 CFG_GLUETUN_WIREGUARD_ADDRESSES=
+CFG_GLUETUN_CONTROL_SERVER_API_KEY_1=RANDOMIZEDPASSWORD1
 # HEALTH_TARGETS = comma-separated host:port list pinged over HTTPS to
 #   confirm the VPN tunnel is healthy. Defaults are privacy-respecting
 #   (Mullvad — your VPN provider; EFF — privacy non-profit). Override

containers/stoat/scripts/stoat_install_hooks.sh

@@ -78,7 +78,7 @@ _stoatBaseUrl()
 # would create directories in their place) and again once the port is known.
 _stoatWriteUrlFiles()
 {
-    local app_dir="$1" base="$2" video_enabled="$3" rabbit_pass="$4"
+    local app_dir="$1" base="$2" video_enabled="$3"
 
     # ws:// for http, wss:// for https — a wss:// URL on a plain-HTTP origin
     # fails to connect and the client hangs on "connecting".
@@ -192,44 +192,31 @@ stoat_install_post_compose()
         "$app_dir/data/caddy-data" "$app_dir/data/caddy-config")
     checkSuccess "Creating $app_name data folders"
 
-    # Ordering rule for everything below: every file bind-mounted into a
-    # container must be written before the first step that could fail. A missing
-    # mount source is not a soft failure — docker either creates a directory in
-    # its place or refuses to start the container, and both outcomes outlive the
-    # install and break every later run.
-    result=$(copyResource "$app_name" "Caddyfile" "" | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1)
-    checkSuccess "Copying Caddyfile to $app_dir"
-
-    local video_enabled=""
-    [[ "$CFG_STOAT_ENABLE_VIDEO" != "false" ]] && video_enabled="true"
-
-    # The port is not allocated yet, so this is a guess whenever there is no
-    # domain; stoat_install_post_start rewrites these once it is known.
-    local base
-    base=$(_stoatBaseUrl "$app_name")
-    _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled"
-    checkSuccess "Writing .env.web, stoat.json and Revolt.toml for $base"
-
     _stoatWriteSecrets "$app_dir/secrets.env"
 
     # Read the LiveKit credentials back out — either the ones just generated or
     # the ones preserved from a previous install — because livekit.yml has to
     # carry the same pair the API is configured with.
-    #
-    # Read via runFileOp: secrets.env is chmod 600 and owned by the docker
-    # install user, while these hooks run as the manager, so a plain grep gets
-    # EACCES and silently yields nothing.
     local livekit_key livekit_secret
-    livekit_key=$(runFileOp grep -oP "REVOLT__API__LIVEKIT__NODES__WORLDWIDE__KEY='\K[^']*" "$app_dir/secrets.env" 2>/dev/null)
-    livekit_secret=$(runFileOp grep -oP "REVOLT__API__LIVEKIT__NODES__WORLDWIDE__SECRET='\K[^']*" "$app_dir/secrets.env" 2>/dev/null)
+    livekit_key=$(grep -oP "REVOLT__API__LIVEKIT__NODES__WORLDWIDE__KEY='\K[^']*" "$app_dir/secrets.env" 2>/dev/null)
+    livekit_secret=$(grep -oP "REVOLT__API__LIVEKIT__NODES__WORLDWIDE__SECRET='\K[^']*" "$app_dir/secrets.env" 2>/dev/null)
     if [[ -z "$livekit_key" || -z "$livekit_secret" ]]; then
-        # Deliberately not fatal. livekit.yml still gets written below so the
-        # bind mount is a file; voice is broken until the keys are fixed, but
-        # the other fifteen services come up and text chat works.
         isError "Could not read the LiveKit credentials from secrets.env — voice will not work."
-        isNotice "Fix the keys in $app_dir/secrets.env and livekit.yml, then restart $app_name."
+        return 1
     fi
 
+    local video_enabled=""
+    [[ "$CFG_STOAT_ENABLE_VIDEO" != "false" ]] && video_enabled="true"
+
+    # The port is not allocated yet, so this is a guess whenever there is no
+    # domain. The files still have to exist now: they are bind-mounted, and
+    # docker would silently create directories in their place otherwise.
+    # stoat_install_post_start rewrites them once the real port is known.
+    local base
+    base=$(_stoatBaseUrl "$app_name")
+    _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled"
+    checkSuccess "Writing .env.web, stoat.json and Revolt.toml for $base"
+
     # use_external_ip lets LiveKit discover the address to advertise for WebRTC.
     # The port range matches the literal UDP mapping in the compose file; change
     # one and you must change the other.
@@ -256,6 +243,9 @@ webhook:
 EOF
     checkSuccess "Writing livekit.yml"
 
+    result=$(copyResource "$app_name" "Caddyfile" "" | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1)
+    checkSuccess "Copying Caddyfile to $app_dir"
+
     runFileOp chown -R "$docker_install_user":"$docker_install_user" "$app_dir"
     checkSuccess "Setting ownership on the $app_name install directory"
 }

containers/traefik/traefik.config

@@ -88,3 +88,4 @@ CFG_TRAEFIK_PORT_3="traefik-service|http|80:80|disabled|tcp|false|false|false|HT
 # AUTH_PROFILE = capability tier for the WebUI auth tools (single_password | user_password | multi_user)
 CFG_TRAEFIK_AUTH_PROFILE=single_password
 CFG_TRAEFIK_ADMIN_USER=
+CFG_TRAEFIK_ADMIN_PASSWORD_1=RANDOMIZEDPASSWORD1

docs/guide/upgrade-notes.md

@@ -160,8 +160,8 @@ are preserved from then on.
 
 The convention is now uniform: **if a config key holds a generated value, its name
 ends in a slot number.** `CFG_<APP>_DB_PASSWORD` became
-`CFG_<APP>_DB_PASSWORD_1`, `CFG_GITEA_ADMIN_PASSWORD` became
-`CFG_GITEA_ADMIN_PASSWORD_1`, and so on — 40 keys across the catalog. An app
+`CFG_<APP>_DB_PASSWORD_1`, `CFG_TRAEFIK_ADMIN_PASSWORD` became
+`CFG_TRAEFIK_ADMIN_PASSWORD_1`, and so on — 42 keys across the catalog. An app
 that needs a second credential of the same kind just adds `_2`; nothing has to be
 registered, because the tag name is derived from the key.
 

scripts/app/auth_adapter.sh

@@ -36,39 +36,12 @@ authAdapterCall() {
 }
 
 # Persist a value to CFG_<APP>_<KEY> in the per-app config file.
-#
-# Adapters call with the bare name (ADMIN_PASSWORD), but a key whose value is
-# generated carries a slot number (CFG_<APP>_ADMIN_PASSWORD_1). Resolve to the
-# slot when the bare key isn't there, so an adapter never has to know how a
-# credential is numbered — and so adding a slot to a config can't quietly
-# disconnect the adapter that writes it.
-#
-# updateConfigOption only rewrites a key that already exists; handed a name that
-# is absent it just prints a notice. That is a silent failure from the caller's
-# side: the app's password really did change, but the config and the WebUI carry
-# on showing the old one. Hence the explicit return 1 and warning below.
 authPersistCfg() {
     local app="$1" key="$2" value="$3"
     local cfg="${containers_dir}${app}/${app}.config"
     [[ ! -f "$cfg" ]] && cfg="${install_containers_dir}/${app}/${app}.config"
     [[ ! -f "$cfg" ]] && return 1
-
-    local app_upper="${app^^}"
-    app_upper="${app_upper//-/_}"
-    local name="CFG_${app_upper}_${key}"
-
-    if ! grep -q "^${name}=" "$cfg" 2>/dev/null; then
-        local slotted
-        slotted=$(grep -oE "^CFG_${app_upper}_${key}_[0-9]+=" "$cfg" 2>/dev/null | head -1)
-        if [[ -n "$slotted" ]]; then
-            name="${slotted%=}"
-        else
-            isNotice "$app has no ${name} (or numbered slot) in $(basename "$cfg") — the new value was applied to the app but not recorded in its config."
-            return 1
-        fi
-    fi
-
-    updateConfigOption "$name" "$value" "$cfg"
+    updateConfigOption "CFG_${app^^}_${key}" "$value" "$cfg"
 }
 
 # Read a tool-modal arg (pipe-encoded) and unescape pipes.

scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh

@@ -525,6 +525,12 @@ PORTEOF
       "type": "password",
       "tooltip": "Password for the mailbox created on install"
     },
+    "TRAEFIK_ADMIN_PASSWORD_1": {
+      "category": "general",
+      "label": "Traefik Admin Password",
+      "type": "password",
+      "tooltip": "Traefik dashboard password (auto-generated)"
+    },
     "BOOKSTACK_APP_KEY_1": {
       "category": "advanced",
       "label": "Application Key",
@@ -598,6 +604,12 @@ PORTEOF
       "type": "password",
       "tooltip": "Password for the seeded Authelia admin account"
     },
+    "GLUETUN_CONTROL_SERVER_API_KEY_1": {
+      "category": "general",
+      "label": "Control Server API Key",
+      "type": "password",
+      "tooltip": "API key for the gluetun HTTP control server (blank disables auth)"
+    },
     "GLUETUN_VPN_SERVICE_PROVIDER": {
       "category": "general",
       "label": "VPN Provider",