Explain how to generate the .env secrets

README.md

@@ -22,16 +22,19 @@ through Caddy. Requires Docker.
 cp .env.example .env
 ```
 
-**2. Generate the secrets** and paste them into `.env`. Strapi refuses to start with the
-placeholder values.
+**2. Generate the secrets.** Every `change-me` must become a different random value —
+Strapi refuses to start otherwise. This fills them all:
 
 ```bash
-openssl rand -base64 32    # run once per secret
+for var in POSTGRES_PASSWORD API_TOKEN_SALT ADMIN_JWT_SECRET TRANSFER_TOKEN_SALT JWT_SECRET ENCRYPTION_KEY; do
+  sed -i "s|^$var=.*|$var=$(openssl rand -base64 32)|" .env
+done
+sed -i "s|^APP_KEYS=.*|APP_KEYS=$(openssl rand -base64 32),$(openssl rand -base64 32)|" .env
+chmod 600 .env
 ```
 
-Fill in `POSTGRES_PASSWORD`, both values of `APP_KEYS`, `API_TOKEN_SALT`,
-`ADMIN_JWT_SECRET`, `TRANSFER_TOKEN_SALT`, `JWT_SECRET` and `ENCRYPTION_KEY`. The domain
-and URL variables can stay as they are for local use.
+`grep change-me .env` must print nothing. The domain and URL variables can stay as they
+are for local use.
 
 **3. Start the stack**
 
@@ -95,8 +98,9 @@ reachable inside the Docker network — do not publish their ports.
 | `PUBLIC_STRAPI_URL` | `https://cms.example.com` |
 | `STRAPI_URL` | leave it as `http://cms:1337` — internal address, never public |
 
-Then generate **fresh** secrets for that machine (`openssl rand -base64 32`), different
-from the development ones. Keep `.env` out of version control; it is already ignored.
+Then generate **fresh** secrets on that machine with the same loop as in development —
+different values from the ones you use locally. Keep `.env` out of version control; it is
+already ignored.
 
 > Changing `APP_KEYS`, `ADMIN_JWT_SECRET` or `JWT_SECRET` later logs everyone out.
 > Changing `ENCRYPTION_KEY` after content exists makes already-encrypted values