[GH-ISSUE #24] Auto-generate NEXTAUTH_SECRET using OpenSSL in container startup #10

New issue

Closed

opened 2026-10-15 13:01:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 13:01:29 +00:00

Owner

Originally created by @salty2011 on GitHub (Jun 12, 2025).
Original GitHub issue: https://github.com/games-on-whales/wolfmanager/issues/24

Originally assigned to: @salty2011 on GitHub.

Summary:

Currently, generating and setting the NEXTAUTH_SECRET requires a manual step:

openssl rand -base64 32

This value must then be added manually to the environment (e.g., via .env or in docker-compose.yml):

NEXTAUTH_SECRET=xyz123

Proposal:

Automate this step by integrating OpenSSL into the container build process and having the container auto-generate a secret on first launch (if not provided). This would involve:

Adding openssl to the container image
On container start, checking if NEXTAUTH_SECRET is set
If not set, running openssl rand -base64 32 and injecting it into the runtime environment

Benefits:

Simplifies setup for new users
Reduces documentation overhead
Ensures secure default behavior out-of-the-box

Optional Enhancements:

Log a warning or info message indicating the generated secret (only in non-production mode)
Optionally persist the secret between restarts via a mounted file or written to default.toml / db

Originally created by @salty2011 on GitHub (Jun 12, 2025). Original GitHub issue: https://github.com/games-on-whales/wolfmanager/issues/24 Originally assigned to: @salty2011 on GitHub. **Summary:** Currently, generating and setting the `NEXTAUTH_SECRET` requires a manual step: ```bash openssl rand -base64 32 ``` This value must then be added manually to the environment (e.g., via `.env` or in `docker-compose.yml`): ```env NEXTAUTH_SECRET=xyz123 ``` **Proposal:** Automate this step by integrating OpenSSL into the container build process and having the container auto-generate a secret on first launch (if not provided). This would involve: * Adding `openssl` to the container image * On container start, checking if `NEXTAUTH_SECRET` is set * If not set, running `openssl rand -base64 32` and injecting it into the runtime environment **Benefits:** * Simplifies setup for new users * Reduces documentation overhead * Ensures secure default behavior out-of-the-box **Optional Enhancements:** * Log a warning or info message indicating the generated secret (only in non-production mode) * Optionally persist the secret between restarts via a mounted file or written to default.toml / db

bsakaguchi

2026-10-15 13:01:29 +00:00