chore(deploy): generate server environment safely

compose.unraid.yaml

@@ -31,4 +31,3 @@ services:
       interval: 10s
       timeout: 5s
       retries: 20
-

deploy/unraid/README.md

@@ -21,6 +21,7 @@ available. Keep `MCP_HUB_REGISTRATION_ENABLED=false` until the central Hub is re
 
 ```bash
 cd /mnt/user/appdata/mobilityops
+./deploy/unraid/configure-env.sh http://192.168.10.150:1236
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api \
   python -m app.cli seed --reset
@@ -39,4 +40,3 @@ docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml ps
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml logs --tail=200
 docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api alembic current
 ```
-

deploy/unraid/configure-env.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+set -eu
+
+public_url="${1:-http://192.168.10.150:1236}"
+
+if [ -e .env ]; then
+  echo "Refusing to overwrite existing .env" >&2
+  exit 1
+fi
+
+cp .env.example .env
+chmod 0600 .env
+
+db_password="$(openssl rand -hex 24)"
+app_secret="$(openssl rand -hex 32)"
+n8n_key="$(openssl rand -hex 32)"
+n8n_password="$(openssl rand -hex 24)"
+callback_token="$(openssl rand -hex 32)"
+mcp_token="$(openssl rand -hex 32)"
+
+sed -i \
+  -e "s|^MOBILITYOPS_ENV=.*|MOBILITYOPS_ENV=production|" \
+  -e "s|^MOBILITYOPS_PUBLIC_URL=.*|MOBILITYOPS_PUBLIC_URL=${public_url}|" \
+  -e "s|^MOBILITYOPS_API_URL=.*|MOBILITYOPS_API_URL=${public_url}|" \
+  -e "s|^DATABASE_URL=.*|DATABASE_URL=postgresql+psycopg://mobilityops:${db_password}@db:5432/mobilityops|" \
+  -e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=${db_password}|" \
+  -e "s|^APP_SECRET=.*|APP_SECRET=${app_secret}|" \
+  -e "s|^N8N_ENCRYPTION_KEY=.*|N8N_ENCRYPTION_KEY=${n8n_key}|" \
+  -e "s|^N8N_BASIC_AUTH_PASSWORD=.*|N8N_BASIC_AUTH_PASSWORD=${n8n_password}|" \
+  -e "s|^MOBILITYOPS_CALLBACK_TOKEN=.*|MOBILITYOPS_CALLBACK_TOKEN=${callback_token}|" \
+  -e "s|^KNOWLEDGE_PROVIDER=.*|KNOWLEDGE_PROVIDER=demo|" \
+  -e "s|^MCP_HUB_REGISTRATION_ENABLED=.*|MCP_HUB_REGISTRATION_ENABLED=false|" \
+  -e "s|^MCP_HUB_SERVICE_TOKEN=.*|MCP_HUB_SERVICE_TOKEN=${mcp_token}|" \
+  .env
+
+unset db_password app_secret n8n_key n8n_password callback_token mcp_token
+
+echo "Created server .env with generated secrets for ${public_url}"