From 73b8cd189c296edbb6d75dba6964612dc86fa6ab Mon Sep 17 00:00:00 2001 From: Florian <52180080+florianjs@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:26:46 +0200 Subject: [PATCH] fix(monitoring): drop basic auth in front of beszel The Beszel UI sends its own token in the Authorization header on every API call. Caddy's basic auth rejected it with WWW-Authenticate: Basic, so the browser asked for the monitoring password again and again. Beszel's own login now protects it. Its account is created on the first start from BESZEL_ADMIN_EMAIL / BESZEL_ADMIN_PASSWORD, which the installer and setup.sh generate, and Caddy refuses /api/beszel/create-user so nobody can claim the UI from the browser. Installs from before keep their Beszel account; the docs explain how to recover a lost password. Co-Authored-By: Claude Opus 5.5 --- .env.example | 6 +-- README.md | 2 +- doc/guide/configuration.md | 4 +- doc/guide/getting-started.md | 14 ++++-- doc/guide/monitoring.md | 23 ++++++--- doc/guide/troubleshooting.md | 23 +++++++-- doc/reference/env.md | 4 +- docker-compose.prod.yml | 5 +- docker/caddy/Caddyfile | 13 ++--- scripts/install.sh | 96 ++++++++++++++++++++++-------------- scripts/setup.sh | 15 ++---- 11 files changed, 126 insertions(+), 79 deletions(-) diff --git a/.env.example b/.env.example index 216430ec..c18e6a2f 100644 --- a/.env.example +++ b/.env.example @@ -122,9 +122,9 @@ IP_HASH_SECRET= # BESZEL_AGENT_TOKEN= # COMPOSE_PROFILES=monitoring -# Monitoring Basic Auth (generate hash with: caddy hash-password) -# MONITORING_USER=admin -# MONITORING_PASSWORD_HASH= +# Beszel login, created on the first start only (change it in Beszel afterwards) +# BESZEL_ADMIN_EMAIL= +# BESZEL_ADMIN_PASSWORD= # ----------------------------------------------------------------------------- # Quick Start diff --git a/README.md b/README.md index d5891406..9d8a2428 100644 --- a/README.md +++ b/README.md @@ -214,7 +214,7 @@ The installer will: - Configure PostgreSQL, Redis, Caddy, and monitoring - Set up Beszel monitoring (host and container stats, alerts) -> **Monitoring**: After installation, open `https://monitoring.your-domain.com` right away. It is protected by basic auth (user `admin`, password shown at the end of the install); behind it, the first visitor creates the Beszel admin account. +> **Monitoring**: After installation, open `https://monitoring.your-domain.com` and log in with the monitoring login shown at the end of the install (email and password, also in `.env` as `BESZEL_ADMIN_EMAIL` / `BESZEL_ADMIN_PASSWORD`). > > Then pair the agent once: in Beszel, click **Add system** with host `/beszel_socket/beszel.sock`, then run `sudo ./scripts/pair-monitoring.sh` on the server and paste the public key and token it shows. Step by step in the [Monitoring guide](https://florianjs.github.io/trackarr/guide/monitoring#pairing-the-agent). > diff --git a/doc/guide/configuration.md b/doc/guide/configuration.md index 50b6da62..104781aa 100644 --- a/doc/guide/configuration.md +++ b/doc/guide/configuration.md @@ -130,9 +130,7 @@ announce.{$DOMAIN} { } {$MONITORING_DOMAIN} { - basicauth { - {$MONITORING_USER:admin} {$MONITORING_PASSWORD_HASH} - } + respond /api/beszel/create-user 403 reverse_proxy trackarr-beszel:8090 } ``` diff --git a/doc/guide/getting-started.md b/doc/guide/getting-started.md index 84eed9e2..e97f9017 100644 --- a/doc/guide/getting-started.md +++ b/doc/guide/getting-started.md @@ -64,7 +64,7 @@ sudo DOMAIN=example.com ACME_EMAIL=admin@example.com ./install.sh --yes `./install.sh --help` lists every option. -After installation, open `https://monitoring.your-domain.com` right away: it is protected by basic auth (user `admin`, password shown at the end of the install), and the first visitor creates the Beszel admin account. Then [pair the agent](/guide/monitoring#pairing-the-agent). +After installation, open `https://monitoring.your-domain.com` and log in with the monitoring login shown at the end of the install (also in `.env`: `BESZEL_ADMIN_EMAIL` / `BESZEL_ADMIN_PASSWORD`). Then [pair the agent](/guide/monitoring#pairing-the-agent). ### Option 2: Docker Setup (Interactive) @@ -161,7 +161,15 @@ Swarms refill as clients re-announce (up to 10 minutes). Upload/download transfe ::: ::: warning Upgrading: monitoring moved to Beszel -Prometheus, Grafana and the exporters are replaced by [Beszel](/guide/monitoring). After pulling, remove the old monitoring containers: +Prometheus, Grafana and the exporters are replaced by [Beszel](/guide/monitoring). After pulling, first add the Beszel login to `.env`: Beszel creates its account from it on its first start, and nobody can create one from the browser. + +```bash +echo "BESZEL_ADMIN_EMAIL=you@example.com" >> .env +echo "BESZEL_ADMIN_PASSWORD=$(openssl rand -base64 16 | tr -d '/+=')" >> .env +grep BESZEL_ADMIN .env # your monitoring login +``` + +Then start Beszel and remove the old monitoring containers: ```bash docker compose -f docker-compose.prod.yml up -d --remove-orphans @@ -174,7 +182,7 @@ docker volume ls docker volume rm _prometheus_data _grafana_data ``` -Then [pair the Beszel agent](/guide/monitoring#pairing-the-agent). `GRAFANA_ADMIN_USER` and `GRAFANA_ADMIN_PASSWORD` can be removed from `.env`. +Log in to `https://monitoring.your-domain.com` and [pair the Beszel agent](/guide/monitoring#pairing-the-agent). `GRAFANA_ADMIN_USER` and `GRAFANA_ADMIN_PASSWORD` can be removed from `.env`. ::: ## Next Steps diff --git a/doc/guide/monitoring.md b/doc/guide/monitoring.md index 22e4f91b..404ac533 100644 --- a/doc/guide/monitoring.md +++ b/doc/guide/monitoring.md @@ -26,7 +26,21 @@ The hub and the agent talk through a shared unix socket (`/beszel_socket/beszel. | Production (`docker-compose.prod.yml`) | `https://$MONITORING_DOMAIN` | | Local production (`docker-compose.local.yml`) | `http://localhost:3001` | -In production, Caddy puts basic auth in front of Beszel (`MONITORING_USER` / `MONITORING_PASSWORD_HASH`, generated by the installer and by `setup.sh`), then Beszel asks for its own login. +Log in with the Beszel account: the email and password in `.env` (`BESZEL_ADMIN_EMAIL` / `BESZEL_ADMIN_PASSWORD`), shown at the end of the install. Beszel creates this account on its first start, so nobody can claim the UI before you; Caddy also refuses the "create the first account" request from outside. On the local production stack (`localhost` only), you create the account on your first visit instead. + +::: info Why there is no browser login prompt +Earlier versions put Caddy basic auth in front of Beszel. The Beszel UI sends its own token in the same `Authorization` header, which basic auth rejects: the browser kept asking for the password. Beszel's own login now protects it. +::: + +::: details Forgot the password, or no Beszel account yet +`BESZEL_ADMIN_*` only apply on Beszel's first start: changing them later does nothing. Instead, create a Beszel superuser from the server: + +```bash +docker exec trackarr-beszel /beszel superuser upsert you@example.com 'a-long-password' +``` + +Then open `https://monitoring.your-domain.com/_/`, log in with it, open the **users** collection, and edit your account's password (or create the account). +::: ### Pairing the agent @@ -34,12 +48,9 @@ Do this once, after the first install (or after upgrading from Grafana). It conn You need two windows: a **browser** for Beszel, and a **terminal on the server** for the agent. -#### 1. Create the Beszel admin account - -Open `https://monitoring.your-domain.com` **right away**: the first visitor creates the Beszel admin account. +#### 1. Log in to Beszel -1. The browser first asks for the basic auth login: user `admin`, and the monitoring password shown at the end of the install. -2. Beszel then asks you to create its own admin account (email and password). Keep them: this is your Beszel login from now on. +Open `https://monitoring.your-domain.com` and log in with the monitoring login shown at the end of the install (also in `.env`: `BESZEL_ADMIN_EMAIL` / `BESZEL_ADMIN_PASSWORD`). #### 2. Add the server in Beszel diff --git a/doc/guide/troubleshooting.md b/doc/guide/troubleshooting.md index 1636e233..a8907f2a 100644 --- a/doc/guide/troubleshooting.md +++ b/doc/guide/troubleshooting.md @@ -339,17 +339,32 @@ e21V5@postgres:5432/trackarr = host=postgres port=5432 auth_user=tracker --- -### Forgot Monitoring Basic Auth Password +### Monitoring Keeps Asking for a Login -**Solutions:** +**Cause:** an install from before this fix still has Caddy basic auth in front of Beszel. The Beszel UI sends its own token in the `Authorization` header, basic auth rejects it, and the browser asks again. -Generate a new hash and put it in `.env` as `MONITORING_PASSWORD_HASH`, doubling every `$` (`$$`) for Docker Compose: +**Solution:** update (`git pull`, or re-run `install.sh`), then restart Caddy: ```bash -printf '%s\n' '' | docker run --rm -i caddy:2-alpine caddy hash-password docker compose -f docker-compose.prod.yml up -d caddy ``` +Then log in with your Beszel account only. `MONITORING_USER` and `MONITORING_PASSWORD_HASH` can be removed from `.env`. + +--- + +### Forgot the Monitoring Password + +**Solutions:** + +`BESZEL_ADMIN_PASSWORD` is only read on Beszel's first start: changing it does nothing afterwards. Create a Beszel superuser instead: + +```bash +docker exec trackarr-beszel /beszel superuser upsert you@example.com 'a-long-password' +``` + +Open `https://monitoring.your-domain.com/_/`, log in with it, open the **users** collection and set a new password on your account. + --- ## Performance Issues diff --git a/doc/reference/env.md b/doc/reference/env.md index 6d241fd4..06bf4ee1 100644 --- a/doc/reference/env.md +++ b/doc/reference/env.md @@ -103,8 +103,8 @@ Production only. See [Monitoring](/guide/monitoring). | Variable | Description | Default | | -------------------------- | ----------------------------------------------------------------------------------------------- | ------- | | `MONITORING_DOMAIN` | Domain serving Beszel through Caddy | `monitoring.localhost` | -| `MONITORING_USER` | Caddy basic auth user in front of Beszel | `admin` | -| `MONITORING_PASSWORD_HASH` | Caddy basic auth password hash (`caddy hash-password`, every `$` doubled as `$$` in `.env`) | — | +| `BESZEL_ADMIN_EMAIL` | Beszel login email, account created on Beszel's first start only | — | +| `BESZEL_ADMIN_PASSWORD` | Beszel login password (8+ characters), first start only: change it in Beszel afterwards | — | | `BESZEL_AGENT_KEY` | Public key shown by Beszel when adding the system (host `/beszel_socket/beszel.sock`) | — | | `BESZEL_AGENT_TOKEN` | Token shown by Beszel with the key | — | | `COMPOSE_PROFILES` | Set to `monitoring` once paired, so the Beszel agent starts | — | diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 48731f65..a8b5eb29 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -19,8 +19,6 @@ services: TRACKER_DOMAIN: ${TRACKER_DOMAIN:-tracker.localhost} MONITORING_DOMAIN: ${MONITORING_DOMAIN:-monitoring.localhost} ACME_EMAIL: ${ACME_EMAIL:-admin@example.com} - MONITORING_USER: ${MONITORING_USER:-admin} - MONITORING_PASSWORD_HASH: ${MONITORING_PASSWORD_HASH:-} volumes: - ./docker/caddy/Caddyfile:/etc/caddy/Caddyfile:ro - caddy_data:/data @@ -352,6 +350,9 @@ services: restart: always environment: APP_URL: https://${MONITORING_DOMAIN:-monitoring.localhost} + # Account created on the first start only (empty data); ignored after + USER_EMAIL: ${BESZEL_ADMIN_EMAIL:-} + USER_PASSWORD: ${BESZEL_ADMIN_PASSWORD:-} volumes: - beszel_data:/beszel_data - beszel_socket:/beszel_socket diff --git a/docker/caddy/Caddyfile b/docker/caddy/Caddyfile index b2458230..f935dc6b 100644 --- a/docker/caddy/Caddyfile +++ b/docker/caddy/Caddyfile @@ -91,13 +91,14 @@ } } -# Monitoring (internal access only - restrict in production) +# Monitoring: Beszel (host and container monitoring, alerts) {$MONITORING_DOMAIN:monitoring.localhost} { - # Basic auth for monitoring endpoints - basicauth { - {$MONITORING_USER:admin} {$MONITORING_PASSWORD_HASH} - } + # No basic auth: the Beszel UI sends its own token in the Authorization + # header, which basic auth rejects, so the browser asks again and again. + # Beszel's login protects it; its account is created from .env on the + # first start (BESZEL_ADMIN_EMAIL / BESZEL_ADMIN_PASSWORD). + # Never let a visitor create the first account + respond /api/beszel/create-user 403 - # Beszel (host and container monitoring, alerts) reverse_proxy trackarr-beszel:8090 } diff --git a/scripts/install.sh b/scripts/install.sh index 3fed3b6e..17258f02 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -241,15 +241,23 @@ prompt_configuration() { step "Configuration" # Re-run: the previous answers are the defaults - KEEP_MONITORING_HASH="" + KEEP_MONITORING_PASSWORD="" + LEGACY_MONITORING=false + BESZEL_ADMIN_EMAIL="" if [[ -f "$INSTALL_DIR/.env" ]]; then log_info "Existing install in $INSTALL_DIR: its settings are the defaults" DOMAIN=${DOMAIN:-$(existing_value DOMAIN)} TRACKER_DOMAIN=${TRACKER_DOMAIN:-$(existing_value TRACKER_DOMAIN)} MONITORING_DOMAIN=${MONITORING_DOMAIN:-$(existing_value MONITORING_DOMAIN)} ACME_EMAIL=${ACME_EMAIL:-$(existing_value ACME_EMAIL)} - # Stored with $ doubled for Docker Compose - KEEP_MONITORING_HASH=$(existing_value MONITORING_PASSWORD_HASH | sed 's/\$\$/$/g') + # Beszel only reads its login on the first start: keep it as is + KEEP_MONITORING_PASSWORD=$(existing_value BESZEL_ADMIN_PASSWORD) + BESZEL_ADMIN_EMAIL=$(existing_value BESZEL_ADMIN_EMAIL) + # Installed before the Beszel login moved to .env: its account was + # created in the Beszel UI, behind the old basic auth + if [[ -z $KEEP_MONITORING_PASSWORD && -n $(existing_value MONITORING_PASSWORD_HASH) ]]; then + LEGACY_MONITORING=true + fi fi if [[ $ASSUME_YES == true ]]; then @@ -271,22 +279,27 @@ prompt_configuration() { ask TRACKER_DOMAIN "Tracker (announce) domain" "${TRACKER_DOMAIN:-announce.$DOMAIN}" is_domain "Not a valid domain name" ask MONITORING_DOMAIN "Monitoring domain" "${MONITORING_DOMAIN:-monitoring.$DOMAIN}" is_domain "Not a valid domain name" ask ACME_EMAIL "Email for Let's Encrypt (expiry notices)" "$ACME_EMAIL" is_email "Not a valid email address" - if [[ -z $MONITORING_PASSWORD ]]; then - if [[ -n $KEEP_MONITORING_HASH ]]; then - read -rsp " Monitoring password (Enter to keep the current one): " MONITORING_PASSWORD - else - read -rsp " Monitoring password (Enter to generate one): " MONITORING_PASSWORD - fi - echo "" + if [[ -z $MONITORING_PASSWORD && -z $KEEP_MONITORING_PASSWORD && $LEGACY_MONITORING != true ]]; then + while true; do + read -rsp " Monitoring login password, 8+ characters (Enter to generate one): " MONITORING_PASSWORD + echo "" + [[ -z $MONITORING_PASSWORD || ${#MONITORING_PASSWORD} -ge 8 ]] && break + log_error "At least 8 characters" + done fi fi + BESZEL_ADMIN_EMAIL=${BESZEL_ADMIN_EMAIL:-$ACME_EMAIL} GENERATED_MONITORING_PASSWORD=false - if [[ -n $MONITORING_PASSWORD ]]; then - KEEP_MONITORING_HASH="" - elif [[ -z $KEEP_MONITORING_HASH ]]; then + if [[ -n $KEEP_MONITORING_PASSWORD ]]; then + MONITORING_PASSWORD=$KEEP_MONITORING_PASSWORD + elif [[ $LEGACY_MONITORING == true ]]; then + MONITORING_PASSWORD="" + elif [[ -z $MONITORING_PASSWORD ]]; then MONITORING_PASSWORD=$(random_string 16) GENERATED_MONITORING_PASSWORD=true + elif [[ ${#MONITORING_PASSWORD} -lt 8 ]]; then + die "MONITORING_PASSWORD needs at least 8 characters" fi check_dns @@ -321,13 +334,19 @@ check_dns() { confirm_plan() { local secrets="generated" password="generated (shown at the end)" [[ -f "$INSTALL_DIR/.env" ]] && secrets="kept from the existing .env" - [[ -n $KEEP_MONITORING_HASH ]] && password="unchanged" - [[ $GENERATED_MONITORING_PASSWORD != true && -n $MONITORING_PASSWORD ]] && password="the one you entered" + if [[ -n $KEEP_MONITORING_PASSWORD ]]; then + password="unchanged" + elif [[ $LEGACY_MONITORING == true ]]; then + password="your existing Beszel account" + elif [[ $GENERATED_MONITORING_PASSWORD != true ]]; then + password="the one you entered" + fi echo "" echo -e " ${BOLD}Summary${NC}" echo -e " Website ${CYAN}https://${DOMAIN}${NC}" echo -e " Announce URL ${CYAN}https://${TRACKER_DOMAIN}/announce${NC}" - echo -e " Monitoring ${CYAN}https://${MONITORING_DOMAIN}${NC} (password: ${password})" + echo -e " Monitoring ${CYAN}https://${MONITORING_DOMAIN}${NC}" + echo -e " Monitoring login ${BESZEL_ADMIN_EMAIL} (password: ${password})" echo -e " Let's Encrypt email ${ACME_EMAIL}" echo -e " Directory ${INSTALL_DIR}" echo -e " Secrets ${secrets}" @@ -515,16 +534,6 @@ generate_secrets() { log_success "Secrets generated in $SECRETS_DIR" fi - # Caddy's basic auth hash, the password going through stdin (never in - # the process list) - if [[ -n $KEEP_MONITORING_HASH ]]; then - MONITORING_PASSWORD_HASH=$KEEP_MONITORING_HASH - else - run "Downloading Caddy" docker pull -q caddy:2-alpine - MONITORING_PASSWORD_HASH=$(printf '%s\n' "$MONITORING_PASSWORD" | docker run --rm -i caddy:2-alpine caddy hash-password 2>>"$LOG_FILE") \ - || die "Could not hash the monitoring password (see $LOG_FILE)" - fi - create_env_file } @@ -543,6 +552,13 @@ create_env_file() { BESZEL_ENV=$(printf '# BESZEL_AGENT_KEY=\n# BESZEL_AGENT_TOKEN=\n# COMPOSE_PROFILES=monitoring') fi + # Beszel login, created on its first start only + if [[ $LEGACY_MONITORING == true ]]; then + BESZEL_LOGIN=$(printf '# Account created in the Beszel UI: these only apply to a new Beszel\n# BESZEL_ADMIN_EMAIL=\n# BESZEL_ADMIN_PASSWORD=') + else + BESZEL_LOGIN=$(printf 'BESZEL_ADMIN_EMAIL=%s\nBESZEL_ADMIN_PASSWORD=%s' "$BESZEL_ADMIN_EMAIL" "$MONITORING_PASSWORD") + fi + cat > "$ENV_FILE" << EOF # ============================================================================= # Trackarr Production Environment Configuration @@ -581,10 +597,9 @@ ACME_EMAIL=${ACME_EMAIL} # Tracker Announce URLs (displayed in admin dashboard) TRACKER_HTTP_URL=https://${TRACKER_DOMAIN}/announce -# Monitoring -MONITORING_USER=admin -# Note: $ escaped as $$ for Docker Compose compatibility -MONITORING_PASSWORD_HASH=$(echo "${MONITORING_PASSWORD_HASH}" | sed 's/\$/\$\$/g') +# Monitoring (Beszel): login read on its first start only, change the +# password in Beszel afterwards +${BESZEL_LOGIN} # Beszel agent, once paired in the monitoring UI (see the Monitoring guide) ${BESZEL_ENV} EOF @@ -716,12 +731,16 @@ print_summary() { echo -e " Announce URL ${CYAN}https://${TRACKER_DOMAIN}/announce${NC}" echo -e " Monitoring ${CYAN}https://${MONITORING_DOMAIN}${NC}" echo "" - echo -e " ${BOLD}Monitoring login${NC} (browser prompt)" - echo -e " User ${CYAN}admin${NC}" - if [[ -n $KEEP_MONITORING_HASH ]]; then - echo -e " Password unchanged" + echo -e " ${BOLD}Monitoring login${NC} (Beszel)" + if [[ $LEGACY_MONITORING == true ]]; then + echo -e " Your existing Beszel account (the browser login prompt is gone)" else - echo -e " Password ${CYAN}${MONITORING_PASSWORD}${NC}" + echo -e " Email ${CYAN}${BESZEL_ADMIN_EMAIL}${NC}" + if [[ -n $KEEP_MONITORING_PASSWORD ]]; then + echo -e " Password unchanged (BESZEL_ADMIN_PASSWORD in .env)" + else + echo -e " Password ${CYAN}${MONITORING_PASSWORD}${NC}" + fi fi echo "" echo -e " ${BOLD}Next steps${NC}" @@ -733,8 +752,8 @@ print_summary() { if [[ $MONITORING_PAIRED == true ]]; then echo -e " 2. Monitoring is paired and running." else - echo -e " 2. Open ${CYAN}https://${MONITORING_DOMAIN}${NC} now: the first visitor creates the" - echo -e " Beszel admin. Click Add system, host ${CYAN}/beszel_socket/beszel.sock${NC}, then run" + echo -e " 2. Open ${CYAN}https://${MONITORING_DOMAIN}${NC} and log in with the monitoring login." + echo -e " Click Add system, host ${CYAN}/beszel_socket/beszel.sock${NC}, then run" echo -e " ${CYAN}sudo ${INSTALL_DIR}/scripts/pair-monitoring.sh${NC} and paste the key and token." echo -e " Step by step: ${CYAN}${DOCS_URL}/guide/monitoring#pairing-the-agent${NC}" fi @@ -846,7 +865,8 @@ Environment variables: TRACKER_DOMAIN Tracker announce domain (default: announce.DOMAIN) MONITORING_DOMAIN Monitoring domain (default: monitoring.DOMAIN) ACME_EMAIL Email for Let's Encrypt - MONITORING_PASSWORD Monitoring password (default: kept, or generated) + MONITORING_PASSWORD Monitoring (Beszel) password for a new install, + 8+ characters (default: generated) INSTALL_DIR Installation directory (default: /opt/trackarr) REPO_URL Git repository URL BRANCH Git branch to check out (default: main) diff --git a/scripts/setup.sh b/scripts/setup.sh index 5af43dea..26f221e1 100755 --- a/scripts/setup.sh +++ b/scripts/setup.sh @@ -113,8 +113,6 @@ TRACKER_INTERNAL_TOKEN=$(openssl rand -hex 32) DB_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') REDIS_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') MONITORING_PASSWORD=$(openssl rand -base64 16 | tr -d '/+=') -# Caddy basic auth in front of the monitoring UI (password via stdin, not argv) -MONITORING_PASSWORD_HASH=$(printf '%s\n' "$MONITORING_PASSWORD" | docker run --rm -i caddy:2-alpine caddy hash-password 2>/dev/null || true) # Update .env file log_info "Updating .env file..." @@ -153,14 +151,9 @@ sed_inplace "s/^TRACKER_INTERNAL_TOKEN=.*/TRACKER_INTERNAL_TOKEN=$TRACKER_INTERN # Tracker URLs sed_inplace "s|^TRACKER_HTTP_URL=.*|TRACKER_HTTP_URL=https://$TRACKER_DOMAIN/announce|" "$PROJECT_DIR/.env" -# Monitoring basic auth ($ doubled for Docker Compose) -if [[ -n "$MONITORING_PASSWORD_HASH" ]]; then - ESCAPED_HASH=$(printf '%s' "$MONITORING_PASSWORD_HASH" | sed 's/\$/\$\$/g') - sed_inplace "s|^# MONITORING_USER=.*|MONITORING_USER=admin|" "$PROJECT_DIR/.env" - sed_inplace "s|^# MONITORING_PASSWORD_HASH=.*|MONITORING_PASSWORD_HASH=$ESCAPED_HASH|" "$PROJECT_DIR/.env" -else - log_warn "Could not hash the monitoring password (Docker unavailable): set MONITORING_PASSWORD_HASH in .env with 'caddy hash-password' before starting" -fi +# Beszel login, created on its first start +sed_inplace "s|^# BESZEL_ADMIN_EMAIL=.*|BESZEL_ADMIN_EMAIL=$ACME_EMAIL|" "$PROJECT_DIR/.env" +sed_inplace "s|^# BESZEL_ADMIN_PASSWORD=.*|BESZEL_ADMIN_PASSWORD=$MONITORING_PASSWORD|" "$PROJECT_DIR/.env" echo "" log_success "Production setup complete!" @@ -168,7 +161,7 @@ echo "" echo -e "${BOLD}Generated credentials (save these!):${NC}" echo -e " Database password: ${CYAN}$DB_PASSWORD${NC}" echo -e " Redis password: ${CYAN}$REDIS_PASSWORD${NC}" -echo -e " Monitoring login: ${CYAN}admin / $MONITORING_PASSWORD${NC}" +echo -e " Monitoring login: ${CYAN}$ACME_EMAIL / $MONITORING_PASSWORD${NC}" echo "" echo -e "${BOLD}Configured domains:${NC}" echo -e " Main: https://$DOMAIN"