39507d60a1
Homebox >= 0.26 (ghcr.io/sysadminsmedia/homebox:0.26.2) panics at boot unless HBOX_AUTH_API_KEY_PEPPER is set to a >= 32-byte value. The seeder ships no Env block, so every clean install crash-loops immediately. Generate a per-install pepper, persist it in the KV store (apps.homebox.apiKeyPepper), and inject it as HBOX_AUTH_API_KEY_PEPPER at every container-create path. The pepper is generated once and reused: rotating it would invalidate every API key a user has issued from Homebox. Inject at all three create paths so no lifecycle action drops it: - _createContainer (install / force-reinstall) - the service update path (heals a pre-fix container on update) - recreateCustomAppContainer (the Edit / reconfigure rebuild — the in-app docs tell users to add HBOX_OPTIONS_ALLOW_REGISTRATION=false via Manage > Edit, which rebuilds Env from container_config alone and would otherwise drop the pepper and re-trigger the crash loop) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| controllers | ||
| exceptions | ||
| jobs | ||
| middleware | ||
| models | ||
| services | ||
| utils | ||
| validators | ||