Refuse a throwaway plugin storage secret in bootstrap, before any role is created

2026-08-18 23:24:34 +02:00
parent bf638dfb19
commit bba048e38f
6 changed files with 25 additions and 11 deletions
@@ -153,6 +153,7 @@ services:
      # `storage` fails the seed loudly. The secret must match web's; both derive the same passwords.
      PLUGIN_DB_ADMIN_URL: ${PLUGIN_DB_ADMIN_URL:-}
      PLUGIN_DB_SECRET: ${PLUGIN_DB_SECRET:-}
+      REQUIRE_SECURE_SECRETS: "true" # refuse the throwaway secret here too, before any role is created
    volumes:
      - ./ory/kratos/tokenizer:/etc/config/kratos/tokenizer
    command: node src/auth/bootstrap.ts