From 847cd059cc1dbd40e5173436a73260ff220181d3 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Sun, 2 Aug 2026 01:48:56 +0200
Subject: [PATCH] chore(deploy): generate server environment safely

---
 compose.unraid.yaml            |  1 -
 deploy/unraid/README.md        |  2 +-
 deploy/unraid/configure-env.sh | 38 ++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100755 deploy/unraid/configure-env.sh

diff --git a/compose.unraid.yaml b/compose.unraid.yaml
index f7ddc8f..0a236bd 100644
--- a/compose.unraid.yaml
+++ b/compose.unraid.yaml
@@ -31,4 +31,3 @@ services:
       interval: 10s
       timeout: 5s
       retries: 20
-
diff --git a/deploy/unraid/README.md b/deploy/unraid/README.md
index d007b9b..ccd7a66 100644
--- a/deploy/unraid/README.md
+++ b/deploy/unraid/README.md
@@ -21,6 +21,7 @@ available. Keep `MCP_HUB_REGISTRATION_ENABLED=false` until the central Hub is re
 
 ```bash
 cd /mnt/user/appdata/mobilityops
+./deploy/unraid/configure-env.sh http://192.168.10.150:1236
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api \
   python -m app.cli seed --reset
@@ -39,4 +40,3 @@ docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml ps
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml logs --tail=200
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api alembic current
 ```
-
diff --git a/deploy/unraid/configure-env.sh b/deploy/unraid/configure-env.sh
new file mode 100755
index 0000000..613beb1
--- /dev/null
+++ b/deploy/unraid/configure-env.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+set -eu
+
+public_url="${1:-http://192.168.10.150:1236}"
+
+if [ -e .env ]; then
+  echo "Refusing to overwrite existing .env" >&2
+  exit 1
+fi
+
+cp .env.example .env
+chmod 0600 .env
+
+db_password="$(openssl rand -hex 24)"
+app_secret="$(openssl rand -hex 32)"
+n8n_key="$(openssl rand -hex 32)"
+n8n_password="$(openssl rand -hex 24)"
+callback_token="$(openssl rand -hex 32)"
+mcp_token="$(openssl rand -hex 32)"
+
+sed -i \
+  -e "s|^MOBILITYOPS_ENV=.*|MOBILITYOPS_ENV=production|" \
+  -e "s|^MOBILITYOPS_PUBLIC_URL=.*|MOBILITYOPS_PUBLIC_URL=${public_url}|" \
+  -e "s|^MOBILITYOPS_API_URL=.*|MOBILITYOPS_API_URL=${public_url}|" \
+  -e "s|^DATABASE_URL=.*|DATABASE_URL=postgresql+psycopg://mobilityops:${db_password}@db:5432/mobilityops|" \
+  -e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${db_password}|" \
+  -e "s|^APP_SECRET=.*|APP_SECRET=${app_secret}|" \
+  -e "s|^N8N_ENCRYPTION_KEY=.*|N8N_ENCRYPTION_KEY=${n8n_key}|" \
+  -e "s|^N8N_BASIC_AUTH_PASSWORD=.*|N8N_BASIC_AUTH_PASSWORD=${n8n_password}|" \
+  -e "s|^MOBILITYOPS_CALLBACK_TOKEN=.*|MOBILITYOPS_CALLBACK_TOKEN=${callback_token}|" \
+  -e "s|^KNOWLEDGE_PROVIDER=.*|KNOWLEDGE_PROVIDER=demo|" \
+  -e "s|^MCP_HUB_REGISTRATION_ENABLED=.*|MCP_HUB_REGISTRATION_ENABLED=false|" \
+  -e "s|^MCP_HUB_SERVICE_TOKEN=.*|MCP_HUB_SERVICE_TOKEN=${mcp_token}|" \
+  .env
+
+unset db_password app_secret n8n_key n8n_password callback_token mcp_token
+
+echo "Created server .env with generated secrets for ${public_url}"