[07rjain]

Split out of #2580 (self-host secret checks).

Old Compose files shipped public NEXTAUTH_SECRET, DATABASE_ENCRYPTION_KEY and MEDIA_SERVER_WEBHOOK_SECRET defaults. Standard/template Compose now require explicit values, and production startup rejects missing or known placeholder secrets. Required-secret interpolation values are quoted so both files parse correctly. Main's encryption-key format validation is preserved.

Upgrade warning / release note: existing installations still using public placeholders will refuse to start after upgrading. Back up MySQL, update the repository and any copied template, configure the secrets, then pull images and rebuild the media server with docker compose pull && docker compose up -d --build. Adding .env values does not replace hardcoded values in an older template. Coolify's generated secrets are unaffected. The guide and a new web changelog entry explain this change.

Rotating DATABASE_ENCRYPTION_KEY makes previously encrypted storage settings, developer app keys and integrations unreadable. Installations that need to upgrade first can keep their exact existing valid key and explicitly set CAP_ALLOW_INSECURE_SECRETS=true on cap-web. This temporary override permits known placeholders, logs a prominent warning on every affected startup, and keeps missing-secret and format validation enforced. Rotate the authentication/webhook secrets, plan the encrypted-data migration or reconfiguration, and remove the override once the encryption key is rotated. Standard/template Compose forward this flag. The media server still requires a unique webhook secret.

README and documentation quick starts create .env and generate all three secrets before starting containers. They remove the temporary .env.bak, which is also ignored by Git. Self-hosting CI now generates unique masked secrets before starting Compose and validates both Compose variants with each required secret missing.

The branch includes current main at 3614bdb692af7317c30c0ad7afaa496a6974c2eb, integrating 174 upstream commits without conflicts.

Validation:

• 20 web startup/secret/format tests and four media-server startup tests passed. The new upgrade regression encrypts credentials before startup and decrypts them after retaining the old key with the override; missing authentication/webhook secrets still fail before startup timers are scheduled.
• Five process-level media startup checks passed, covering missing, placeholder, unique and override cases.
• The exact CI configuration and validation scripts passed locally without starting containers. Both Compose variants load with generated secrets, reject each missing required secret, forward the upgrade override and keep webhook values identical between services.
• Both documented quick-start generation blocks passed in temporary directories and left no backup files.
• Repository bun run typecheck, scoped Biome checks, MDX compilation, workflow YAML/shell syntax checks and media-server bundling passed. Biome does not process Markdown/MDX/YAML; those were validated separately where applicable.
• Direct media-server TypeScript checking retains the same seven diagnostics previously verified on unchanged main. Full container startup was not run locally.

The displayed Greptile 5/5 score is from an earlier commit; review of this head and maintainer approval for fork CI remain pending.

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are fixed and no new blocking issue was found.

Summary

This PR removes public secret defaults and adds startup checks for self-hosted deployments.

• Self-hosted services require explicit secrets before they start.
• Self-hosting guides generate secrets and explain how upgrades affect them.

Both previous findings are fixed. No new actionable issues were found. Container startup was not run during this review.

_{Reviews (3) · Last reviewed commit: "fix(self-host): exercise required secret..." · Reviewed by Greptile}

[vercel]

@07rjain is attempting to deploy a commit to the Cap Software Inc Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Compose files cannot load

The unquoted secret values contain : in (run: openssl rand -hex 32), which breaks YAML syntax. Docker Compose cannot read either compose file, even when all three secrets are set. Quote the entire ${...} value at every changed secret entry in both docker-compose.yml and docker-compose.template.yml.

Prompt To Fix With AI

This is a comment left during a code review.
Path: docker-compose.yml
Line: 17-19

Comment:
**Compose files cannot load**

The unquoted secret values contain `: ` in `(run: openssl rand -hex 32)`, which breaks YAML syntax. Docker Compose cannot read either compose file, even when all three secrets are set. Quote the entire `${...}` value at every changed secret entry in both `docker-compose.yml` and `docker-compose.template.yml`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Template upgrade steps miss secrets

The older docker-compose.template.yml sets secrets directly, so adding new values to .env does not replace them. docker compose pull only updates images; users following these steps still pass the public secrets to the new web image, which refuses to start. Tell template users to update their compose file or replace its hardcoded values before restarting.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/web/content/docs/self-hosting.mdx
Line: 211-212

Comment:
**Template upgrade steps miss secrets**

The older `docker-compose.template.yml` sets secrets directly, so adding new values to `.env` does not replace them. `docker compose pull` only updates images; users following these steps still pass the public secrets to the new web image, which refuses to start. Tell template users to update their compose file or replace its hardcoded values before restarting.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[richiemcilroy]

Thanks @07rjain for splitting this out and for the detailed upgrade section, that's exactly what we were hoping for. Quoting the values in eae90b6 fixes Greptile's P1: both compose files parse now, and docker compose config shows the "Set ... in .env" message when a secret is missing. A few things are still open:

1. Upgrade steps don't update the compose files or the media server (Greptile P2, apps/web/content/docs/self-hosting.mdx:208-212). Valid, and it goes a bit further. Anyone using an older docker-compose.template.yml copy has the secrets hardcoded, so adding them to .env changes nothing. On top of that, docker-compose.yml and the template build the media server from source (build:), so docker compose pull doesn't update it either. Please make step 3 something like git pull, then docker compose pull && docker compose up -d --build, and add a line telling template users to replace the three hardcoded values in their copy (or switch to the new template) before restarting.
2. No way to keep data encrypted with the old key (apps/web/instrumentation.node.ts:31-42). The media server has MEDIA_SERVER_ALLOW_INSECURE_SECRET, but cap-web has no override. An install that has been running on the old default DATABASE_ENCRYPTION_KEY has to rotate it as part of the upgrade and loses its S3 storage settings, developer app keys and integrations, as the docs say. Could you give cap-web an explicit opt-in override too (for example CAP_ALLOW_INSECURE_SECRETS=true, with a loud warning logged on every start) so people can upgrade first and rotate when they are ready, and document it in the upgrade section as a temporary measure? A small re-encryption script that takes the old and new keys would be even better, but the override is enough for this PR.
3. Quick starts still say one command (README.md:83, self-hosting.mdx:14-22 and step 2 at line 55). With the defaults gone, docker compose up -d on a fresh clone now fails until .env exists, but both quick starts still show it as the only step followed by "That's it!". Please move the cp .env.self-hosting.example .env and secret generation steps into the Quick Start code block itself and into the README.
4. Coolify isn't affected (self-hosting.mdx:199). docker-compose.coolify.yml uses ${SERVICE_HEX_32_*}, which Coolify generates per deployment, so Coolify installs never had fixed example secrets. Please drop Coolify from that sentence, or say Coolify users don't need to do anything.
5. The branch is about 155 commits behind main. Please merge main so CI runs against current code.

We need Greptile at 5/5 on the latest commit and green CI before we can merge. After pushing, you can mention @greptileai in a comment to get a re-review. Thanks!

[07rjain]

@greptileai please re-review the latest changes on commit 8d826e4. The branch now includes current main, the upgrade and secret-check fixes, and the updated self-hosting CI validation.