halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

build(deploy)!: Learn's session pepper is LEARN_SESSION_KEY_HASH_PEPPER, as Train's and Todo's are prefixed

Browse source 
SESSION_KEY_HASH_PEPPER went to Learn's server alone, beside
TRAIN_SESSION_KEY_HASH_PEPPER and TODO_SESSION_KEY_HASH_PEPPER. The
pepper's value stays: changed, everyone would be signed out of Learn.
POSTGRES_PASSWORD keeps its name, as it is the instance's PostgreSQL
superuser's, not Learn's alone.

BREAKING CHANGE: an instance's deploy/.env must set
LEARN_SESSION_KEY_HASH_PEPPER (SESSION_KEY_HASH_PEPPER's value) before
this is deployed; without it Compose stops at once, and the deploy fails
before anything is switched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-11-02 18:50:34 +01:00
commit 384fc38919
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
deploy/.env.example
View file

@ -95,15 +95,17 @@ LEARN_DOMAIN=http://localhost
#TODO_POSTGRES_PASSWORD=
#TODO_SESSION_KEY_HASH_PEPPER=
# Postgres password, shared by the postgres and server services.
# Generate: openssl rand -base64 32
# The password of the instance's PostgreSQL superuser, halkyon_learn, which Learn's
# server signs in as, and backups and deploys dump as (Train's and Todo's servers have
# roles of their own). Generate: openssl rand -base64 32
POSTGRES_PASSWORD=
# Pepper for hashing session keys (server-side sessions). NEVER change it once
# sessions exist: everyone would be signed out, and anonymous accounts can't sign
# back in. Rotation only via fallbackSessionKeyHashPeppers.
# Generate: openssl rand -base64 32
SESSION_KEY_HASH_PEPPER=
# Learn's pepper for hashing session keys (server-side sessions), as Train's and Todo's
# are TRAIN_ and TODO_SESSION_KEY_HASH_PEPPER (named SESSION_KEY_HASH_PEPPER until
# 2 Nov 2026). NEVER change its value once sessions exist: everyone would be signed out
# of Learn, and anonymous accounts can't sign back in. Rotation only via
# fallbackSessionKeyHashPeppers. Generate: openssl rand -base64 32
LEARN_SESSION_KEY_HASH_PEPPER=
# Email sign-in (optional, ADR 0010): people sign in with a code mailed to their address,
# of which the instance keeps only a keyed hash. Off unless the pepper and all of the SMTP

2
deploy/compose.yaml
View file

@ -73,7 +73,7 @@ services:
required: false
environment:
SERVERPOD_DATABASE_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}
SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper: ${SESSION_KEY_HASH_PEPPER:?set SESSION_KEY_HASH_PEPPER in deploy/.env}
SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper: ${LEARN_SESSION_KEY_HASH_PEPPER:?set LEARN_SESSION_KEY_HASH_PEPPER in deploy/.env}
# Email sign-in (ADR 0010), only with the pepper and an SMTP service; empty: off.
SERVERPOD_PASSWORD_emailSignInPepper: ${EMAIL_SIGN_IN_PEPPER:-}
SERVERPOD_PASSWORD_emailSmtpHost: ${EMAIL_SMTP_HOST:-}