4 Commits

Include renames

Author	SHA1	Message	Date
jochen	8928e6f972	nextcloud: keep onlyoffice's jwt_secret off every argv (issue 1831) ... occ's config:app:set put the secret on the docker exec command line, so it sat in the docker CLI's argv, the container's php argv and docker's exec record. Apply jwt_secret through config:import on occ's stdin instead; the other three onlyoffice keys still go through config:app:set.	2026-10-22 16:27:15 +02:00
jochen	2d2e831659	Apply only-office's bound address and secret to onlyoffice settings every tick (issue 1830)	2026-10-22 11:30:26 +02:00
jochen	d3ebaf72eb	Require only-office's document server and carry its address and secret into nextcloud's config (issue 1830)	2026-10-22 11:27:49 +02:00
jochen	fe2040c65e	Keep every password, token and API key the vault's, never a setting (hq issue 342) ... A setting outranked the vault: baserow, grafana, letta and unifi merged a layer's password over the ${secret:...} in their runtime config, and the gitea, home-assistant, icecast, influxdb, mailu and nextcloud clients read the settings file before the vault's file. A secret in a setting cannot be rotated and is read back by the settings verb. The four files now keep their password protected, so the controller refuses a setting of it. The six clients ignore a secret in the settings file and say so once, by key and never with the value; icecast reads its admin password from the vault's file. checks/secrets refuses a mergeable file whose secret a layer could replace; searxng's nested server.secret_key is listed as known until the controller protects a nested key.	2026-10-13 07:32:19 +02:00