From 22a99f804e9e9f8bd0c5f38b88ac655cca8d72d2 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Wed, 1 Jul 2026 19:13:19 +0000
Subject: [PATCH] Generate missing secrets in --only mode for existing installs

SETTINGS_DB_PASS and SETTINGS_SECRET won't be in the credentials file
on stacks installed before settings was added. Generate and append them
automatically so --only settings works without a full reinstall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 install-stack.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/install-stack.sh b/install-stack.sh
index b4993f8..d11c3b0 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -962,6 +962,18 @@ if [[ "${1:-}" == "--only" ]]; then
     key="${line%%=*}"; value="${line#*=}"
     export "$key"="$value"
   done < "$CREDS_FILE"
+  # Generate and append any secrets that didn't exist when the stack was first installed
+  _append_secret() {
+    local var=$1 val=$2
+    export "$var"="$val"
+    echo "${var}=${val}" >> "$CREDS_FILE"
+    msg_ok "Generated missing secret: ${var}"
+  }
+  [[ -z "${SETTINGS_DB_PASS:-}" ]] && _append_secret SETTINGS_DB_PASS \
+    "$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)"
+  [[ -z "${SETTINGS_SECRET:-}" ]]  && _append_secret SETTINGS_SECRET \
+    "$(openssl rand -hex 32)"
+
   USE_FORGEJO=true
   [[ -f /root/.ssh/hotel-manage_deploy.pub ]] \
     && MGMT_PUBKEY=$(cat /root/.ssh/hotel-manage_deploy.pub) || MGMT_PUBKEY=""