davide/blog
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Explain how to generate the .env secrets

Browse Source
This commit is contained in:
davide
2026-08-25 11:45:41 +02:00
parent c9ee871c44
commit d97fd3f92f
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12 -8
View File
@@ -22,16 +22,19 @@ through Caddy. Requires Docker.
cp .env.example .env cp .env.example .env
``` ```
**2. Generate the secrets** and paste them into `.env`. Strapi refuses to start with the **2. Generate the secrets.** Every `change-me` must become a different random value —
placeholder values. Strapi refuses to start otherwise. This fills them all:
```bash ```bash
openssl rand -base64 32 # run once per secret for var in POSTGRES_PASSWORD API_TOKEN_SALT ADMIN_JWT_SECRET TRANSFER_TOKEN_SALT JWT_SECRET ENCRYPTION_KEY; do
sed -i "s|^$var=.*|$var=$(openssl rand -base64 32)|" .env
done
sed -i "s|^APP_KEYS=.*|APP_KEYS=$(openssl rand -base64 32),$(openssl rand -base64 32)|" .env
chmod 600 .env
``` ```
Fill in `POSTGRES_PASSWORD`, both values of `APP_KEYS`, `API_TOKEN_SALT`, `grep change-me .env` must print nothing. The domain and URL variables can stay as they
`ADMIN_JWT_SECRET`, `TRANSFER_TOKEN_SALT`, `JWT_SECRET` and `ENCRYPTION_KEY`. The domain are for local use.
and URL variables can stay as they are for local use.
**3. Start the stack** **3. Start the stack**
@@ -95,8 +98,9 @@ reachable inside the Docker network — do not publish their ports.
| `PUBLIC_STRAPI_URL` | `https://cms.example.com` | | `PUBLIC_STRAPI_URL` | `https://cms.example.com` |
| `STRAPI_URL` | leave it as `http://cms:1337` — internal address, never public | | `STRAPI_URL` | leave it as `http://cms:1337` — internal address, never public |
Then generate **fresh** secrets for that machine (`openssl rand -base64 32`), different Then generate **fresh** secrets on that machine with the same loop as in development —
from the development ones. Keep `.env` out of version control; it is already ignored. different values from the ones you use locally. Keep `.env` out of version control; it is
already ignored.
> Changing `APP_KEYS`, `ADMIN_JWT_SECRET` or `JWT_SECRET` later logs everyone out. > Changing `APP_KEYS`, `ADMIN_JWT_SECRET` or `JWT_SECRET` later logs everyone out.
> Changing `ENCRYPTION_KEY` after content exists makes already-encrypted values > Changing `ENCRYPTION_KEY` after content exists makes already-encrypted values