fix: replace hardcoded secrets with environment variables

- Replace hardcoded Redis password with REDIS_PASSWORD env var
- Replace hardcoded JWT secret with JWT_SECRET env var
- Update .env.example with placeholder values instead of 'secret'
- Remove duplicate 'services:' key in docker-compose.yml

Author: frozenbanana

.env.example

@@ -5,7 +5,10 @@ API_URL=https://hejbit.local
 
 POSTGRES_DB=swarmbox
 POSTGRES_USER=swarmbox
-POSTGRES_PASSWORD=secret
+POSTGRES_PASSWORD=your_postgres_password_here
 
-NEXTCLOUD_ADMIN_USER=swarmbox
-NEXTCLOUD_ADMIN_PASSWORD=swarmbox
+REDIS_PASSWORD=your_redis_password_here
+JWT_SECRET=your_jwt_secret_here
+
+NEXTCLOUD_ADMIN_USER=admin
+NEXTCLOUD_ADMIN_PASSWORD=your_admin_password_here

docker-compose.yml

@@ -6,8 +6,6 @@
 #  127.0.0.1 adminer.hejbit.local
 #  127.0.0.1 features.hejbit.local
 
-services:
-
 services:
   web:
     build: ./docker/web
@@ -81,8 +79,9 @@ services:
     #    ports:
     #      - '6379:6379'
     restart: unless-stopped
+    command: redis-server --requirepass ${REDIS_PASSWORD:-secret}
     healthcheck:
-      test: ["CMD", "redis-cli", "-a", "secret", "ping"]
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-secret}", "ping"]
       start_period: 3s
       timeout: 5s
       interval: 30s
@@ -99,7 +98,16 @@ services:
     volumes:
       - nc-db:/var/lib/postgresql/data
     healthcheck:
-      test: [ "CMD", "pg_isready", "-q", "-d", "${POSTGRES_DB}", "-U", "${POSTGRES_USER}" ]
+      test:
+        [
+          "CMD",
+          "pg_isready",
+          "-q",
+          "-d",
+          "${POSTGRES_DB}",
+          "-U",
+          "${POSTGRES_USER}",
+        ]
       start_period: 3s
       timeout: 5s
       interval: 30s
@@ -141,7 +149,7 @@ services:
         condition: service_healthy
     labels:
       caddy: adminer.hejbit.local
-      caddy.reverse_proxy: '{{upstreams 8080}}'
+      caddy.reverse_proxy: "{{upstreams 8080}}"
     environment:
       ADMINER_DEFAULT_SERVER: postgres
 
@@ -150,16 +158,16 @@ services:
       - feature
     image: ghcr.io/open-feature/flagd:latest
     restart: unless-stopped
-    command: 'start --uri file:/etc/flagd/hejbit.flagd.json --cors-origin *'
+    command: "start --uri file:/etc/flagd/hejbit.flagd.json --cors-origin *"
     #    ports:
     #      - '8013:8013'
     volumes:
-      - './docker/flagd/hejbit.flagd.json:/etc/flagd/hejbit.flagd.json'
+      - "./docker/flagd/hejbit.flagd.json:/etc/flagd/hejbit.flagd.json"
     networks:
       - proxy
     labels:
       caddy: features.hejbit.local
-      caddy.reverse_proxy: '{{upstreams 8013}}'
+      caddy.reverse_proxy: "{{upstreams 8013}}"
     depends_on:
       proxy:
         condition: service_healthy
@@ -170,7 +178,7 @@ services:
     image: onlyoffice/documentserver
     environment:
       JWT_ENABLED: true
-      JWT_SECRET: secret
+      JWT_SECRET: ${JWT_SECRET:-secret}
       JWT_HEADER: AuthorizationJwt
       JWT_IN_BODY: true
       USE_UNAUTHORIZED_STORAGE: true
@@ -187,7 +195,7 @@ services:
       - proxy
     labels:
       caddy: onlyoffice.local
-      caddy.reverse_proxy: '{{upstreams 80}}'
+      caddy.reverse_proxy: "{{upstreams 80}}"
     depends_on:
       proxy:
         condition: service_healthy
@@ -229,7 +237,6 @@ volumes:
   onlyoffice_lib:
   onlyoffice_logs:
 
-
 networks:
   frontend:
   backend:

docker/nextcloud/hooks/post-installation/003-install-onlyoffice.sh

@@ -7,5 +7,5 @@ php occ config:app:set onlyoffice DocumentServerUrl --value="https://onlyoffice.
 php occ config:app:set onlyoffice DocumentServerInternalUrl --value="https://onlyoffice.local/"
 php occ config:app:set onlyoffice StorageUrl --value="https://nextcloud.local/"
 php occ config:system:set onlyoffice verify_peer_off --value="true"
-php occ config:system:set onlyoffice jwt_secret --value="secret"
+php occ config:system:set onlyoffice jwt_secret --value="${JWT_SECRET:-secret}"
 php occ config:system:set onlyoffice jwt_header --value="AuthorizationJwt"