From d97fd3f92f0fa90acff65a89d6c9fe3774186a59 Mon Sep 17 00:00:00 2001
From: Davide Grilli <davide.grilli@outlook.com>
Date: Tue, 25 Aug 2026 11:45:41 +0200
Subject: [PATCH] Explain how to generate the .env secrets

---
 README.md | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 0d25f9c..729695b 100644
--- a/README.md
+++ b/README.md
@@ -22,16 +22,19 @@ through Caddy. Requires Docker.
 cp .env.example .env
 ```
 
-**2. Generate the secrets** and paste them into `.env`. Strapi refuses to start with the
-placeholder values.
+**2. Generate the secrets.** Every `change-me` must become a different random value —
+Strapi refuses to start otherwise. This fills them all:
 
 ```bash
-openssl rand -base64 32    # run once per secret
+for var in POSTGRES_PASSWORD API_TOKEN_SALT ADMIN_JWT_SECRET TRANSFER_TOKEN_SALT JWT_SECRET ENCRYPTION_KEY; do
+  sed -i "s|^$var=.*|$var=$(openssl rand -base64 32)|" .env
+done
+sed -i "s|^APP_KEYS=.*|APP_KEYS=$(openssl rand -base64 32),$(openssl rand -base64 32)|" .env
+chmod 600 .env
 ```
 
-Fill in `POSTGRES_PASSWORD`, both values of `APP_KEYS`, `API_TOKEN_SALT`,
-`ADMIN_JWT_SECRET`, `TRANSFER_TOKEN_SALT`, `JWT_SECRET` and `ENCRYPTION_KEY`. The domain
-and URL variables can stay as they are for local use.
+`grep change-me .env` must print nothing. The domain and URL variables can stay as they
+are for local use.
 
 **3. Start the stack**
 
@@ -95,8 +98,9 @@ reachable inside the Docker network — do not publish their ports.
 | `PUBLIC_STRAPI_URL` | `https://cms.example.com` |
 | `STRAPI_URL` | leave it as `http://cms:1337` — internal address, never public |
 
-Then generate **fresh** secrets for that machine (`openssl rand -base64 32`), different
-from the development ones. Keep `.env` out of version control; it is already ignored.
+Then generate **fresh** secrets on that machine with the same loop as in development —
+different values from the ones you use locally. Keep `.env` out of version control; it is
+already ignored.
 
 > Changing `APP_KEYS`, `ADMIN_JWT_SECRET` or `JWT_SECRET` later logs everyone out.
 > Changing `ENCRYPTION_KEY` after content exists makes already-encrypted values