Persist a per-install JWT signing secret instead of a compiled-in default.

Admin tokens were forgeable whenever JWT_SECRET was unset. Prefer the env var, otherwise write a random key to data/.jwt_secret.
2026-08-31 23:55:34 +00:00
parent 466d69c44c
commit 22844a2a67
6 changed files with 106 additions and 7 deletions
@@ -47,6 +47,7 @@ See docker-compose.yml for full example (exposes 80/81/443, volume for data/).
 - `data/db.bolt` (or `DATA_DIR`)
 - `data/certs/`, `data/logs/`, `data/letsencrypt-acme-challenge/`
 - `data/www/` (default site / custom html; `WWW_DIR` or `HTML_DIR`)
+- `data/.jwt_secret` (auto-generated admin API signing key if `JWT_SECRET` is unset)
 - etc.

 ## Status