From 86dd283acd3f2c8d20148d7efb119235965ce758 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Wed, 1 Jul 2026 19:46:08 +0000
Subject: [PATCH] Self-generate missing DB passwords in deploy functions for
 --only installs

---
 install-stack.sh | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/install-stack.sh b/install-stack.sh
index c977d23..66a3bd3 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -800,6 +800,17 @@ EOF
 deploy_settings() {
   msg_step "7/7  Settings service (LXC 116 · 10.10.10.116)"
 
+  if [[ -z "${SETTINGS_DB_PASS:-}" ]]; then
+    SETTINGS_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
+    printf '\nSETTINGS_DB_PASS=%s\n' "$SETTINGS_DB_PASS" >> "$CREDS_FILE"
+    msg_ok "Generated SETTINGS_DB_PASS → ${CREDS_FILE}"
+  fi
+  if [[ -z "${SETTINGS_SECRET:-}" ]]; then
+    SETTINGS_SECRET=$(openssl rand -hex 32)
+    printf 'SETTINGS_SECRET=%s\n' "$SETTINGS_SECRET" >> "$CREDS_FILE"
+    msg_ok "Generated SETTINGS_SECRET → ${CREDS_FILE}"
+  fi
+
   msg_info "Creating LXC 116"
   create_lxc 116 "10.10.10.116" "settings" 512 1
   msg_ok "LXC 116 created"
@@ -833,6 +844,13 @@ EOF
 deploy_cashup() {
   msg_step "8/8  Cashup (LXC 117 · 10.10.10.117)"
 
+  # Generate DB password if not already in creds file (--only cashup on existing stack)
+  if [[ -z "${CASHUP_DB_PASS:-}" ]]; then
+    CASHUP_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
+    printf '\nCASHUP_DB_PASS=%s\n' "$CASHUP_DB_PASS" >> "$CREDS_FILE"
+    msg_ok "Generated CASHUP_DB_PASS → ${CREDS_FILE}"
+  fi
+
   msg_info "Creating LXC 117"
   create_lxc 117 "10.10.10.117" "cashup" 1024 1
   msg_ok "LXC 117 created"