feat(dev): ensure-env generates all self-owned secrets (PMS-490) #390

Merged

Claude-Run merged 1 commit from feat/PMS-490-ensure-env-generates-secrets into main

2026-06-26 16:49:21 +02:00

Claude-Run commented

2026-06-26 16:39:11 +02:00

Member

ensure-env previously did test -f .env || cp .env.example .env, copying the generic dev secrets verbatim into .env (MOKOSH_PG_PASSWORD=postgres, MOKOSH_APP_PASSWORD=mokosh_app_dev, JWT_SECRET=change-this..., etc.). Now the create path generates a strong random value for every self-owned secret so no generic password ever survives into .env.

Generated keys and formats: MOKOSH_PG_PASSWORD / MOKOSH_MIGRATOR_PASSWORD / MOKOSH_APP_PASSWORD / INFISICAL_PG_PASSWORD are hex (URL-safe alphanumeric, 48 chars) so they interpolate raw into postgres:// URLs; ENCRYPTION_KEY and JWT_SECRET are 64 hex chars (32 bytes / 256-bit); INFISICAL_ENCRYPTION_KEY is 32 hex chars (16 bytes); INFISICAL_AUTH_SECRET is base64 of 32 random bytes. The host-side URL lines (DATABASE_URL, MOKOSH_ADMIN_DATABASE_URL, MOKOSH_APP_DATABASE_URL, INFISICAL_DB_CONNECTION_URI) are rebuilt from the same generated passwords so sqlx-cli stays consistent with the container roles compose provisions from the knobs.

Only the create path generates; an existing .env is left untouched, so the recipe stays idempotent as a dependency of dev/dev-infisical/pre-commit. Third-party credentials (Google, Stripe, Twilio, Slack, Infisical client, SMTP) cannot be generated and remain empty placeholders.

.env.example no longer ships generic values for the self-owned keys: their values are emptied and the embedded URL passwords blanked, with comments pointing at ensure-env as the generator.

#PMS-490

ensure-env previously did `test -f .env || cp .env.example .env`, copying the generic dev secrets verbatim into .env (MOKOSH_PG_PASSWORD=postgres, MOKOSH_APP_PASSWORD=mokosh_app_dev, JWT_SECRET=change-this..., etc.). Now the create path generates a strong random value for every self-owned secret so no generic password ever survives into .env. Generated keys and formats: MOKOSH_PG_PASSWORD / MOKOSH_MIGRATOR_PASSWORD / MOKOSH_APP_PASSWORD / INFISICAL_PG_PASSWORD are hex (URL-safe alphanumeric, 48 chars) so they interpolate raw into postgres:// URLs; ENCRYPTION_KEY and JWT_SECRET are 64 hex chars (32 bytes / 256-bit); INFISICAL_ENCRYPTION_KEY is 32 hex chars (16 bytes); INFISICAL_AUTH_SECRET is base64 of 32 random bytes. The host-side URL lines (DATABASE_URL, MOKOSH_ADMIN_DATABASE_URL, MOKOSH_APP_DATABASE_URL, INFISICAL_DB_CONNECTION_URI) are rebuilt from the same generated passwords so sqlx-cli stays consistent with the container roles compose provisions from the knobs. Only the create path generates; an existing .env is left untouched, so the recipe stays idempotent as a dependency of dev/dev-infisical/pre-commit. Third-party credentials (Google, Stripe, Twilio, Slack, Infisical client, SMTP) cannot be generated and remain empty placeholders. .env.example no longer ships generic values for the self-owned keys: their values are emptied and the embedded URL passwords blanked, with comments pointing at ensure-env as the generator. #PMS-490

Claude-Run added 1 commit

2026-06-26 16:39:11 +02:00

feat(dev): ensure-env generates all self-owned secrets (PMS-490)

E2E / Playwright against staging (pull_request) Successful in 25s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 1m53s

Details

Integration / integration tests (pull_request) Successful in 9m45s

Details

Create release / Gate (release-branch merges only) (pull_request) Successful in 1s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

75c11b91fc

ensure-env previously did `test -f .env || cp .env.example .env`, copying the generic dev secrets verbatim into .env (MOKOSH_PG_PASSWORD=postgres, MOKOSH_APP_PASSWORD=mokosh_app_dev, JWT_SECRET=change-this..., etc.). Now the create path generates a strong random value for every self-owned secret so no generic password ever survives into .env.

Generated keys and formats: MOKOSH_PG_PASSWORD / MOKOSH_MIGRATOR_PASSWORD / MOKOSH_APP_PASSWORD / INFISICAL_PG_PASSWORD are hex (URL-safe alphanumeric, 48 chars) so they interpolate raw into postgres:// URLs; ENCRYPTION_KEY and JWT_SECRET are 64 hex chars (32 bytes / 256-bit); INFISICAL_ENCRYPTION_KEY is 32 hex chars (16 bytes); INFISICAL_AUTH_SECRET is base64 of 32 random bytes. The host-side URL lines (DATABASE_URL, MOKOSH_ADMIN_DATABASE_URL, MOKOSH_APP_DATABASE_URL, INFISICAL_DB_CONNECTION_URI) are rebuilt from the same generated passwords so sqlx-cli stays consistent with the container roles compose provisions from the knobs.

Only the create path generates; an existing .env is left untouched, so the recipe stays idempotent as a dependency of dev/dev-infisical/pre-commit. Third-party credentials (Google, Stripe, Twilio, Slack, Infisical client, SMTP) cannot be generated and remain empty placeholders.

.env.example no longer ships generic values for the self-owned keys: their values are emptied and the embedded URL passwords blanked, with comments pointing at ensure-env as the generator.

#PMS-490